From 95bf46c1e4f3efe304857074bfa7d324d9f85fe9 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Thu, 19 Mar 2026 12:44:50 +0100
Subject: [PATCH] escape HTML in autodiscover logs

---
 data/web/js/site/dashboard.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/data/web/js/site/dashboard.js b/data/web/js/site/dashboard.js
index 760e878f1..aee361710 100644
--- a/data/web/js/site/dashboard.js
+++ b/data/web/js/site/dashboard.js
@@ -1128,6 +1128,11 @@ jQuery(function($){
           item.ua = escapeHtml(item.ua);
         }
         item.ua = '<span style="font-size:small">' + item.ua + '</span>';
+        if (item.user == null) {
+          item.user = 'unknown';
+        } else {
+          item.user = escapeHtml(item.user);
+        }
         if (item.service == "activesync") {
           item.service = '<span class="badge fs-6 bg-info">ActiveSync</span>';
         }