URL parameter 'source' is passed into JS without sufficient validation

[Ysincit]

Hi, I have checked that no CVE exists for that, up to now, but you may like to create one. In share/pnp/application/controllers/system.php the parameter 'source' is read this way: $this->source = pnp::clean($this->input->get('source',NULL)); pnp::clean does a htmlspecialchars(), but will do nothing with ;} and so on. Because of that, the direct output of the variable 'source' into a JavaScript in pnp4nagios/share/application/views/zoom.php: var source = <?php echo $this->source?>; is a problem e.g. test it with ...&source=null;%7d%7d);alert('X.S.S');x=(y=function()%7bz=function()%7b

Regards!

[lingej]

I will have a look! Thanks

[lingej]

fixed wit commit 685ff48