webcpanel: escape values in template_fileserver

Remove other escapes to prevent double escape.

Not all replaced values were escaped, such as replies from commands.

1 files changed, 5 insertions, 1 deletions

diff --git a/modules/webcpanel/template_fileserver.cpp b/modules/webcpanel/template_fileserver.cpp
index 341058659..8c6cd10a6 100644
--- a/modules/webcpanel/template_fileserver.cpp
+++ b/modules/webcpanel/template_fileserver.cpp
@@ -238,7 +238,11 @@ void TemplateFileServer::Serve(HTTPProvider *server, const Anope::string &page_n
 
 				if (ifok && forok)
 				{
-					const Anope::string &replacement = FindReplacement(r, content.substr(0, f - 1));
+					Anope::string replacement = FindReplacement(r, content.substr(0, f - 1));
+
+					// htmlescape all text replaced onto the page
+					replacement = HTTPUtils::Escape(replacement);
+
 					finished += replacement;
 				}
 			}