From f7fc917904760eeb61a3c32c36cc8e8055fada54 Mon Sep 17 00:00:00 2001
From: John Horne <john.horne@plymouth.ac.uk>
Date: Thu, 7 Sep 2017 10:54:29 +0100
Subject: [PATCH] The LDAP bind password should not be interpreted as HTML.

---
 website_code/php/management/site.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website_code/php/management/site.php b/website_code/php/management/site.php
index f457a00820..dd6ac69a65 100644
--- a/website_code/php/management/site.php
+++ b/website_code/php/management/site.php
@@ -182,7 +182,7 @@
 
     echo "<p>" . MANAGEMENT_SITE_LDAP_PORT . "<form><textarea id=\"ldap_port\">" . $row['ldap_port'] . "</textarea></form></p>";
 
-    echo "<p>" . MANAGEMENT_SITE_LDAP_PASSWORD . "<form><textarea id=\"bind_pwd\">" . $row['bind_pwd'] . "</textarea></form></p>";
+    echo "<p>" . MANAGEMENT_SITE_LDAP_PASSWORD . "<form><textarea id=\"bind_pwd\">" . htmlspecialchars($row['bind_pwd']) . "</textarea></form></p>";
 
     echo "<p>" . MANAGEMENT_SITE_LDAP_BASE . "<form><textarea id=\"base_dn\">" . $row['basedn'] . "</textarea></form></p>";