CVE-2005-4294

@@ -1,7 +1,7 @@
 /*
  * File   : $Source: /alkacon/cvs/opencms/history.txt,v $
- * Date   : $Date: 2005/11/09 10:37:04 $
- * Version: $Revision: 1.704 $
+ * Date   : $Date: 2005/11/10 07:31:21 $
+ * Version: $Revision: 1.705 $
  *
  * This file is part of OpenCms -
  * the Open Source Content Mananagement System
@@ -24,6 +24,7 @@ OpenCms 6.0.3 - xxxxxxxxx, 2005
 * Improved error handling in XML page loader for locale selection process
 * Added fix for error handler in localized Xerces versions
 * Fixed issue #982: If tomcat path has spaces, the log file is not set
+* Fixed potential security issues in login dialog with username not being escaped
 
 OpenCms 6.0.2 - October 13, 2005
 * Fixed issue #615: Uploading modules with new (unknown) resource type classes

@@ -1,7 +1,7 @@
 /*
  * File   : $Source: /alkacon/cvs/opencms/src/org/opencms/workplace/CmsLogin.java,v $
- * Date   : $Date: 2005/10/10 16:11:03 $
- * Version: $Revision: 1.21 $
+ * Date   : $Date: 2005/11/10 07:31:21 $
+ * Version: $Revision: 1.22 $
  *
  * This library is part of OpenCms -
  * the Open Source Content Mananagement System
@@ -63,7 +63,7 @@
  *
  * @author Alexander Kandzior 
  * 
- * @version $Revision: 1.21 $ 
+ * @version $Revision: 1.22 $ 
  * 
  * @since 6.0.0 
  */
@@ -557,7 +557,7 @@ protected String displayLoginForm() {
             html.append("<input style=\"width: 100%\" type=\"text\"");
             appendId(html, PARAM_USERNAME);
             html.append("value=\"");
-            html.append(CmsStringUtil.isEmpty(m_username) ? "" : m_username);
+            html.append(CmsStringUtil.isEmpty(m_username) ? "" : CmsEncoder.escapeXml(m_username));
             html.append("\">");
         } else if (m_action == ACTION_LOGIN) {
             // append name of user that has been logged in