Improper escaping of error message leads to XSS during template import preview

[joelister]

the XSS issue has been found on templates_import.php (Cacti 1.2.13). The vulnerability could be exploited by an attacker by forcing a user to upload a file with a "name" or "xml_path" containing client-side code

[netniV]

Thank you for reporting this to us so. I have patched this now to prevent the message from being used to report an issue.

If you do obtain a CVE for this, we can update the changelog afterwards.