yes, not committing the setup file to the same VCS is a security thing

[git.ikiwiki.info.git] / IkiWiki / CGI.pm

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index cbc2fe8eb0c6ce8b0e2b6ac5089e42fdd79b7037..243662386a55f84fc21c6959e136b4de3eaec27c 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -488,6 +488,9 @@ sub cgi (;$$) {
 sub cgierror ($) {
        my $message=shift;
 
+       eval q{use HTML::Entities};
+       $message = encode_entities($message);
+
        print "Content-type: text/html\n\n";
        print cgitemplate(undef, gettext("Error"),
                "<p class=\"error\">".gettext("Error").": $message</p>");