php/import.php: Quote unknown action output

jpatokal · Sep 16, 2024 · 18fd3a9 · 18fd3a9
1 parent 9d15e3e
commit 18fd3a9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/php/import.php b/php/import.php
@@ -355,7 +355,7 @@ function die_nicely($msg) {
         break;
 
     default:
-        die_nicely(sprintf(_("Unknown action %s"), $action));
+        die_nicely(sprintf(_("Unknown action %s"), htmlspecialchars($action)));
 }
 
 $fileType = $_POST["fileType"];