Escape generated password in mobileconfig

Escape ampersand, less than, greater than to avoid generating invalid XML. Fixes #7171
2026-05-11 06:25:28 +00:00 · 2026-05-02 16:24:01 +02:00
1 changed files with 1 additions and 1 deletions
@@ -52,7 +52,7 @@ if (isset($_GET['app_password'])) {
  else
      $platform = $_SERVER['HTTP_USER_AGENT'];

-  $password = password_generate();
+  $password = htmlspecialchars(password_generate(), ENT_NOQUOTES);

  $attr = array(
      'app_name' => $platform,