From 01b44a08c9f66e410dce0d92b27ffd764d949c65 Mon Sep 17 00:00:00 2001
From: Fabio Bas
Date: Mon, 26 Jul 2010 20:06:51 +0000
Subject: patch for #858

git-svn-id: https://svn.kvirc.de/svn/trunk/kvirc@4693 17fca916-40b9-46aa-a4ea-0a15b648b75c
---
 src/modules/dcc/requests.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/modules/dcc/requests.cpp')

diff --git a/src/modules/dcc/requests.cpp b/src/modules/dcc/requests.cpp
index f758d36ec..e4aad108d 100644
--- a/src/modules/dcc/requests.cpp
+++ b/src/modules/dcc/requests.cpp
@@ -86,7 +86,8 @@ static void dcc_module_request_error(KviDccRequest * dcc,const QString& errText)
 	if(KVI_OPTION_BOOL(KviOption_boolNotifyFailedDccHandshakes))
 	{
 		QString szError = QString("Sorry, your DCC %1 request can't be satisfied: %2").arg(dcc->szType.ptr(), errText);
-		dcc_module_reply_errmsg(dcc,szError);
+		//since szError contains an user-suppplied string, we simplify it to avoid any kind of injection (bug #858)
+		dcc_module_reply_errmsg(dcc,szError.simplified());
 	}
 }
 
-- 
cgit v1.3.1-10-gc9f91