From 595f7dee40b303606d2f7047236fe030398566a5 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Thu, 14 Feb 2008 23:55:02 +0000
Subject: [PATCH] Better quoting

---
 group_chooser.cgi | 3 ++-
 user_chooser.cgi  | 9 +++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/group_chooser.cgi b/group_chooser.cgi
index 3cab9d247..2c997248f 100755
--- a/group_chooser.cgi
+++ b/group_chooser.cgi
@@ -33,7 +33,8 @@ if ($in{'multi'}) {
 				@mems = &unique( split(/ /, $ginfo[3]),
 						 @{$members{$ginfo[2]}} );
 				if (@mems > 3) { @mems = (@mems[0..1], "..."); }
-				print "selr[$i] = \"",join(' ', @mems),"\";\n";
+				print "selr[$i] = \"",
+				  &quote_escape(join(' ', @mems), "'"),"\";\n";
 				}
 			else { print "selr[$i] = \"???\";\n"; }
 			}
diff --git a/user_chooser.cgi b/user_chooser.cgi
index b0fde4860..24c16d954 100755
--- a/user_chooser.cgi
+++ b/user_chooser.cgi
@@ -22,8 +22,13 @@ if ($in{'multi'}) {
 			print "sel[$i] = \"".
 			      &quote_escape($ul[$i], '"')."\";\n";
 			@uinfo = getpwnam($ul[$i]);
-			if (@uinfo) { print "selr[$i] = \"$uinfo[6]\";\n"; }
-			else { print "selr[$i] = \"???\";\n"; }
+			if (@uinfo) {
+				print "selr[$i] = \"".
+				      &quote_escape($uinfo[6])."\";\n"; }
+				}
+			else {
+				print "selr[$i] = \"???\";\n";
+				}
 			}
 		print "</script>\n";
 		print "<title>$text{'users_title1'}</title>\n";