From 1782b45d4b73cd3adb244ece78393b277fedd157 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 1 Sep 2015 12:17:02 -0400
Subject: [PATCH] Encode the rule description before displaying back to the
 user in an error when attempting to delete an in-use alias.

---
 usr/local/www/firewall_aliases.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/local/www/firewall_aliases.php b/usr/local/www/firewall_aliases.php
index d4efcf54c7..7e9ce2085f 100644
--- a/usr/local/www/firewall_aliases.php
+++ b/usr/local/www/firewall_aliases.php
@@ -106,7 +106,7 @@ if ($_GET['act'] == "del") {
 		// Static routes
 		find_alias_reference(array('staticroutes', 'route'), array('network'), $alias_name, $is_alias_referenced, $referenced_by);
 		if($is_alias_referenced == true) {
-			$savemsg = sprintf(gettext("Cannot delete alias. Currently in use by %s"), $referenced_by);
+			$savemsg = sprintf(gettext("Cannot delete alias. Currently in use by %s"), htmlspecialchars($referenced_by));
 		} else {
 			unset($a_aliases[$_GET['id']]);
 			if (write_config()) {