fixes #1075 - XSS in "Active Devices" Panel of Admin Dashboard

1 files changed, 12 insertions, 1 deletions

diff --git a/MediaBrowser.Server.Implementations/HttpServer/Security/AuthorizationContext.cs b/MediaBrowser.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
index 509a00ff9..75d54a80a 100644
--- a/MediaBrowser.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
+++ b/MediaBrowser.Server.Implementations/HttpServer/Security/AuthorizationContext.cs
@@ -175,11 +175,22 @@ namespace MediaBrowser.Server.Implementations.HttpServer.Security
 
                 if (param.Length == 2)
                 {
-                    result.Add(param[0], param[1].Trim(new[] { '"' }));
+					var value = NormalizeValue (param[1].Trim(new[] { '"' }));
+                    result.Add(param[0], value);
                 }
             }
 
             return result;
         }
+
+		private string NormalizeValue(string value)
+		{
+			if (string.IsNullOrWhiteSpace (value)) 
+			{
+				return value;
+			}
+
+			return System.Net.WebUtility.HtmlEncode(value);
+		}
     }
 }