diff -u xymon-4.3.0~beta2.dfsg/debian/control xymon-4.3.0~beta2.dfsg/debian/control
--- xymon-4.3.0~beta2.dfsg/debian/control
+++ xymon-4.3.0~beta2.dfsg/debian/control
@@ -1,7 +1,8 @@
 Source: xymon
 Section: net
 Priority: extra
-Maintainer: Christoph Berg <myon@debian.org>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Christoph Berg <myon@debian.org>
 Build-Depends: debhelper (>= 7), librrd-dev, libssl-dev, libldap2-dev, libpcre3-dev,
  imagemagick, po-debconf, quilt (>= 0.40)
 Standards-Version: 3.8.3
diff -u xymon-4.3.0~beta2.dfsg/debian/changelog xymon-4.3.0~beta2.dfsg/debian/changelog
--- xymon-4.3.0~beta2.dfsg/debian/changelog
+++ xymon-4.3.0~beta2.dfsg/debian/changelog
@@ -1,3 +1,13 @@
+xymon (4.3.0~beta2.dfsg-5ubuntu0.1) lucid-security; urgency=low
+
+  * SECURITY UPDATE: Multiple cross site scripting (XSS) vulnerabilities
+    (LP: #1092412)
+    - debian/patches/9-CVE-2011-1716.patch: show user input as html quoted
+      output. Based on upstream changes.
+    - CVE-2011-1716
+
+ -- Christian Kuersteiner <ckuerste@gmx.ch>  Tue, 15 Jan 2013 13:39:32 +0700
+
 xymon (4.3.0~beta2.dfsg-5) unstable; urgency=low
 
   * Add HTMLCHARSET headers to all html pages generated.
diff -u xymon-4.3.0~beta2.dfsg/debian/patches/series xymon-4.3.0~beta2.dfsg/debian/patches/series
--- xymon-4.3.0~beta2.dfsg/debian/patches/series
+++ xymon-4.3.0~beta2.dfsg/debian/patches/series
@@ -16,0 +17 @@
+9-CVE-2011-1716
only in patch2:
unchanged:
--- xymon-4.3.0~beta2.dfsg.orig/debian/patches/9-CVE-2011-1716
+++ xymon-4.3.0~beta2.dfsg/debian/patches/9-CVE-2011-1716
@@ -0,0 +1,705 @@
+Description: fix for XSS vulnerabilities in Web UI
+Origin: upstream
+Author: ckuerste@gmx.ch
+Bug: http://xymon.svn.sourceforge.net/viewvc/xymon/branches/4.3.2/Changes?revision=6673&view=markup
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/precise/+source/xymon/+bug/1092412
+Index: xymon-4.3.0~beta2.dfsg/lib/eventlog.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/eventlog.c	2009-02-19 17:46:56.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/eventlog.c	2013-01-14 15:22:29.482972789 +0700
+@@ -544,7 +544,7 @@
+ 	if (fromtime) {
+ 		firstevent = eventreport_time(fromtime);
+ 		if(firstevent < 0) {
+-			if (output) fprintf(output,"<B>Invalid 'from' time: %s</B>", fromtime);
++			if (output) fprintf(output,"<B>Invalid 'from' time: %s</B>", htmlquoted(fromtime));
+ 			return;
+ 		}
+ 	}
+@@ -562,7 +562,7 @@
+ 	if (totime) {
+ 		lastevent = eventreport_time(totime);
+ 		if (lastevent < 0) {
+-			if (output) fprintf(output,"<B>Invalid 'to' time: %s</B>", totime);
++			if (output) fprintf(output,"<B>Invalid 'to' time: %s</B>", htmlquoted(totime));
+ 			return;
+ 		}
+ 		if (lastevent < firstevent) {
+@@ -715,7 +715,7 @@
+ 		countlist_t *cwalk;
+ 		unsigned long totalcount = 0;
+ 
+-		if (periodstring) fprintf(output, "<p><font size=+1>%s</font></p>\n", periodstring);
++		if (periodstring) fprintf(output, "<p><font size=+1>%s</font></p>\n", htmlquoted(periodstring));
+ 
+ 		switch (sumtype) {
+ 		  case S_HOST_BREAKDOWN:
+@@ -778,7 +778,7 @@
+ 		fprintf(output, "<BR><BR>\n");
+ 		fprintf(output, "<TABLE SUMMARY=\"$EVENTSTITLE\" BORDER=0>\n");
+ 		fprintf(output, "<TR BGCOLOR=\"#333333\">\n");
+-		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD></TR>\n", title);
++		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD></TR>\n", htmlquoted(title));
+ 
+ 		for (ewalk=eventhead; (ewalk); ewalk=ewalk->next) {
+ 			char *hostname = bbh_item(ewalk->host, BBH_HOSTNAME);
+@@ -835,7 +835,7 @@
+ 		fprintf(output, "<CENTER><BR>\n");
+ 		fprintf(output, "<TABLE SUMMARY=\"%s\" BORDER=0>\n", title);
+ 		fprintf(output, "<TR BGCOLOR=\"#333333\">\n");
+-		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD>\n", title);
++		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD>\n", htmlquoted(title));
+ 		fprintf(output, "</TR>\n");
+ 		fprintf(output, "</TABLE>\n");
+ 		fprintf(output, "</CENTER>\n");
+Index: xymon-4.3.0~beta2.dfsg/lib/headfoot.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/headfoot.c	2009-02-17 23:05:46.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/headfoot.c	2013-01-14 15:27:15.138971622 +0700
+@@ -1463,7 +1463,7 @@
+ 		xfree(templatedata);
+ 	}
+ 	else {
+-		fprintf(output, "<HTML><BODY> \n <HR size=4> \n <BR>%s is either missing or invalid, please create this file with your custom header<BR> \n<HR size=4>", filename);
++		fprintf(output, "<HTML><BODY> \n <HR size=4> \n <BR>%s is either missing or invalid, please create this file with your custom header<BR> \n<HR size=4>", htmlquoted(filename));
+ 	}
+ 
+ 	/* Check for bulletin files */
+Index: xymon-4.3.0~beta2.dfsg/lib/htmllog.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/htmllog.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/htmllog.c	2013-01-14 16:40:34.850953635 +0700
+@@ -80,7 +80,7 @@
+ 			<INPUT TYPE=HIDDEN NAME=\"IP\" VALUE=\"%s\"> \
+ 			<INPUT TYPE=HIDDEN NAME=\"DISPLAYNAME\" VALUE=\"%s\"> \
+ 			</FORM></CENTER>\n",
+-			cgibinurl, btntxt, hostname, service, ip, displayname);
++			cgibinurl, htmlquoted(btntxt), htmlquoted(hostname), htmlquoted(service), htmlquoted(ip), htmlquoted(displayname));
+ 	}
+ 
+ 	xfree(tmp2);
+@@ -161,7 +161,7 @@
+ 
+ 	hostsvc_setup();
+ 	if (!displayname) displayname = hostname;
+-	sethostenv(displayname, ip, service, colorname(color), hostname);
++	sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(color), htmlquoted(hostname));
+ 	if (logtime) sethostenv_snapshot(logtime);
+ 
+ 	if (is_history) tplfile = "histlog";
+@@ -254,9 +254,9 @@
+ 				strftime(untilstr, sizeof(untilstr)-1, "%Y-%m-%d %H:%M", localtime(&validuntil));
+ 				fprintf(output, "<tr>");
+ 				fprintf(output, "<td align=center><font %s>%d</font></td>", ackfont, level);
+-				fprintf(output, "<td><font %s>%s</font></td>", ackfont, ackedby);
++				fprintf(output, "<td><font %s>%s</font></td>", ackfont, htmlquoted(ackedby));
+ 				fprintf(output, "<td><font %s>%s&nbsp;-&nbsp;%s</font></td>", ackfont, receivedstr, untilstr);
+-				fprintf(output, "<td><font %s>%s</font></td>", ackfont, msg);
++				fprintf(output, "<td><font %s>%s</font></td>", ackfont, htmlquoted(msg));
+ 				fprintf(output, "</tr>\n");
+ 			}
+ 
+@@ -274,12 +274,12 @@
+ 	}
+ 
+ 	fprintf(output, "<CENTER><TABLE ALIGN=CENTER BORDER=0 SUMMARY=\"Detail Status\">\n");
+-	if (wantserviceid) fprintf(output, "<TR><TH><FONT %s>%s - %s</FONT><BR><HR WIDTH=\"60%%\"></TH></TR>\n", rowfont, displayname, service);
++	if (wantserviceid) fprintf(output, "<TR><TH><FONT %s>%s - %s</FONT><BR><HR WIDTH=\"60%%\"></TH></TR>\n", rowfont, htmlquoted(displayname), htmlquoted(service));
+ 
+ 	if (disabletime != 0) {
+ 		fprintf(output, "<TR><TD><H3>Disabled until %s</H3></TD></TR>\n", 
+ 			(disabletime == -1 ? "OK" : ctime(&disabletime)));
+-		fprintf(output, "<TR><TD><PRE>%s</PRE></TD></TR>\n", dismsg);
++		fprintf(output, "<TR><TD><PRE>%s</PRE></TD></TR>\n", htmlquoted(dismsg));
+ 		fprintf(output, "<TR><TD><BR><HR>Current status message follows:<HR><BR></TD></TR>\n");
+ 
+ 		fprintf(output, "<TR><TD>");
+@@ -295,7 +295,7 @@
+ 		char *txt = skipword(firstline);
+ 
+ 		if (dismsg) {
+-			fprintf(output, "<TR><TD><H3>Planned downtime: %s</H3></TD></TR>\n", dismsg);
++			fprintf(output, "<TR><TD><H3>Planned downtime: %s</H3></TD></TR>\n", htmlquoted(dismsg));
+ 			fprintf(output, "<TR><TD><BR><HR>Current status message follows:<HR><BR></TD></TR>\n");
+ 		}
+ 
+@@ -333,12 +333,12 @@
+ 		if (ackedby) {
+ 			*ackedby = '\0';
+ 			fprintf(output, "<font %s>Current acknowledgment: %s<br>%s<br>%s</font><br>\n", 
+-				ackfont, ackmsg, (ackedby+1), ackuntil);
++				ackfont, htmlquoted(ackmsg), (ackedby+1), ackuntil);
+ 			*ackedby = '\n';
+ 		}
+ 		else {
+ 			fprintf(output, "<font %s>Current acknowledgment: %s<br>%s</font><br>\n", 
+-				ackfont, ackmsg, ackuntil);
++				ackfont, htmlquoted(ackmsg), ackuntil);
+ 		}
+ 
+ 		MEMUNDEFINE(ackuntil);
+Index: xymon-4.3.0~beta2.dfsg/lib/notifylog.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/notifylog.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/notifylog.c	2013-01-15 10:08:48.553849002 +0700
+@@ -120,7 +120,7 @@
+ 	if (fromtime) {
+ 		firstevent = convert_time(fromtime);
+ 		if(firstevent < 0) {
+-			fprintf(output,"<B>Invalid 'from' time: %s</B>", fromtime);
++			fprintf(output,"<B>Invalid 'from' time: %s</B>", htmlquoted(fromtime));
+ 			return;
+ 		}
+ 	}
+@@ -134,7 +134,7 @@
+ 	if (totime) {
+ 		lastevent = convert_time(totime);
+ 		if (lastevent < 0) {
+-			fprintf(output,"<B>Invalid 'to' time: %s</B>", totime);
++			fprintf(output,"<B>Invalid 'to' time: %s</B>", htmlquoted(totime));
+ 			return;
+ 		}
+ 		if (lastevent < firstevent) {
+@@ -314,7 +314,7 @@
+ 		fprintf(output, "<BR><BR>\n");
+ 		fprintf(output, "<TABLE SUMMARY=\"Notification log\" BORDER=0>\n");
+ 		fprintf(output, "<TR BGCOLOR=\"#333333\">\n");
+-		fprintf(output, "<TD ALIGN=CENTER COLSPAN=4><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD></TR>\n", title);
++		fprintf(output, "<TD ALIGN=CENTER COLSPAN=4><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD></TR>\n", htmlquoted(title));
+ 		fprintf(output, "<TR BGCOLOR=\"#333333\"><TH>Time</TH><TH>Host</TH><TH>Service</TH><TH>Recipient</TH></TR>\n");
+ 
+ 		for (walk=head; (walk != lasttoshow->next); walk=walk->next) {
+@@ -352,7 +352,7 @@
+ 		fprintf(output, "<CENTER><BR>\n");
+ 		fprintf(output, "<TABLE SUMMARY=\"%s\" BORDER=0>\n", title);
+ 		fprintf(output, "<TR BGCOLOR=\"#333333\">\n");
+-		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD>\n", title);
++		fprintf(output, "<TD ALIGN=CENTER COLSPAN=6><FONT SIZE=-1 COLOR=\"#33ebf4\">%s</FONT></TD>\n", htmlquoted(title));
+ 		fprintf(output, "</TR>\n");
+ 		fprintf(output, "</TABLE>\n");
+ 		fprintf(output, "</CENTER>\n");
+Index: xymon-4.3.0~beta2.dfsg/lib/reportlog.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/reportlog.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/reportlog.c	2013-01-15 10:11:42.753851953 +0700
+@@ -34,7 +34,7 @@
+ 	int curbg = 0;
+ 
+ 	if (!displayname) displayname = hostname;
+-	sethostenv(displayname, ip, service, colorname(color), hostname);
++	sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(color), htmlquoted(hostname));
+ 	sethostenv_report(st, end, reportwarnlevel, reportgreenlevel);
+ 
+ 	headfoot(htmlrep, "replog", "", "header", color);
+@@ -42,7 +42,7 @@
+ 	fprintf(htmlrep, "\n");
+ 
+ 	fprintf(htmlrep, "<CENTER>\n");
+-	fprintf(htmlrep, "<BR><FONT %s><B>%s - %s</B></FONT>\n", xgetenv("MKBBROWFONT"), displayname, service);
++	fprintf(htmlrep, "<BR><FONT %s><B>%s - %s</B></FONT>\n", xgetenv("MKBBROWFONT"), htmlquoted(displayname), htmlquoted(service));
+ 	fprintf(htmlrep, "<TABLE BORDER=0 BGCOLOR=\"#333333\" CELLPADDING=3 SUMMARY=\"Availability percentages\">\n");
+ 	fprintf(htmlrep, "<TR>\n");
+ 
+Index: xymon-4.3.0~beta2.dfsg/lib/strfunc.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/strfunc.c	2009-02-26 17:14:12.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/strfunc.c	2013-01-15 10:22:27.881862885 +0700
+@@ -177,3 +177,35 @@
+ 	*(buf->s+buf->used) = '\0';
+ }
+ 
++char *htmlquoted(char *s)
++{
++	/*
++    	 * This routine converts a plain string into an html-quoted string
++    	 */
++
++	static strbuffer_t *result = NULL;
++	char *inp, *endp;
++	char c;
++
++	if (!result) result = newstrbuffer(4096);
++	clearstrbuffer(result);
++
++	inp= s;
++	do {
++		endp = inp + strcspn(inp, "\"&<> ");
++		c = *endp;
++		if (endp > inp) addtobufferraw(result, inp, endp-inp);
++		switch (c) {
++		  case '"': addtobuffer(result, "&quot;"); break;
++		  case '&': addtobuffer(result, "&amp;"); break;
++		  case '<': addtobuffer(result, "&lt;"); break;
++		  case '>': addtobuffer(result, "&gt;"); break;
++		  case ' ': addtobuffer(result, "&nbsp;"); break;
++		  default: break;
++		}
++		inp = (c == '\0') ? NULL : endp+1;
++	} while (inp);
++
++	return STRBUF(result);
++}
++
+Index: xymon-4.3.0~beta2.dfsg/lib/strfunc.h
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/lib/strfunc.h	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/lib/strfunc.h	2013-01-15 10:24:18.765864763 +0700
+@@ -24,6 +24,7 @@
+ extern void strbufferrecalc(strbuffer_t *buf);
+ extern void strbuffergrow(strbuffer_t *buf, int bytes);
+ extern void strbufferuse(strbuffer_t *buf, int bytes);
++extern char *htmlquoted(char *s);
+ 
+ #endif
+ 
+Index: xymon-4.3.0~beta2.dfsg/web/hobbit-ackinfo.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbit-ackinfo.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbit-ackinfo.c	2013-01-15 10:25:38.277866111 +0700
+@@ -122,7 +122,7 @@
+ 	fprintf(stdout, "Content-type: %s\n", xgetenv("HTMLCONTENTTYPE"));
+ 	fprintf(stdout, "Location: %s\n", getenv("HTTP_REFERER"));
+ 	fprintf(stdout, "\n");
+-	fprintf(stdout, "Sent to hobbitd:\n%s\n", bbmsg);
++	fprintf(stdout, "Sent to hobbitd:\n%s\n", htmlquoted(bbmsg));
+ 
+ 	return 0;
+ }
+Index: xymon-4.3.0~beta2.dfsg/web/bb-ack.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-ack.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-ack.c	2013-01-15 10:27:29.645867998 +0700
+@@ -159,16 +159,16 @@
+ 
+ 	fprintf(output, "<tr>\n");
+ 
+-	fprintf(output, "    <td>%s</td>\n", (hname ? hname : "&nbsp;"));
+-	fprintf(output, "    <td>%s</td>\n", (tname ? tname : "&nbsp;"));
++	fprintf(output, "    <td>%s</td>\n", (hname ? htmlquoted(hname) : "&nbsp;"));
++	fprintf(output, "    <td>%s</td>\n", (tname ? htmlquoted(tname) : "&nbsp;"));
+ 	fprintf(output, "    <TD><INPUT TYPE=TEXT NAME=\"DELAY_%s\" SIZE=8 MAXLENGTH=20></TD>\n", numstr);
+ 	fprintf(output, "    <TD><INPUT TYPE=TEXT NAME=\"MESSAGE_%s\" SIZE=60 MAXLENGTH=80></TD>\n", numstr);
+ 
+ 	fprintf(output, "    <TD>\n");
+ 	if (ackcode && hname && tname) {
+-		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"NUMBER_%d\" VALUE=\"%s\">\n", num, ackcode);
+-		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"HOSTNAME_%d\" VALUE=\"%s\">\n", num, hname);
+-		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"TESTNAME_%d\" VALUE=\"%s\">\n", num, tname);
++		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"NUMBER_%d\" VALUE=\"%s\">\n", num, htmlquoted(ackcode));
++		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"HOSTNAME_%d\" VALUE=\"%s\">\n", num, htmlquoted(hname));
++		fprintf(output, "       <INPUT TYPE=\"HIDDEN\" NAME=\"TESTNAME_%d\" VALUE=\"%s\">\n", num, htmlquoted(tname));
+ 		fprintf(output, "       <INPUT TYPE=\"SUBMIT\" NAME=\"Send_%d\" VALUE=\"Send\" ALT=\"Send\">\n", num);
+ 	}
+ 	else {
+Index: xymon-4.3.0~beta2.dfsg/web/hobbit-enadis.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbit-enadis.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbit-enadis.c	2013-01-15 10:32:47.153873377 +0700
+@@ -199,7 +199,7 @@
+ 
+ 			if (preview) {
+ 				printf("<tr><td>Enabling host <b>%s</b> test <b>%s</b> : %s</td></tr>\n", 
+-					hostname, enabletest[i], ((result == BB_OK) ? "OK" : "Failed"));
++					htmlquoted(hostname), htmlquoted(enabletest[i]), ((result == BB_OK) ? "OK" : "Failed"));
+ 			}
+ 		}
+ 		break;
+@@ -219,7 +219,7 @@
+ 
+ 			if (preview) {
+ 				printf("<tr><td>Disabling host <b>%s</b> test <b>%s</b>: %s</td></tr>\n", 
+-					hostname, disabletest[i], ((result == BB_OK) ? "OK" : "Failed"));
++					htmlquoted(hostname), htmlquoted(disabletest[i]), ((result == BB_OK) ? "OK" : "Failed"));
+ 			}
+ 		}
+ 		break;
+@@ -232,7 +232,7 @@
+ 
+ 			if (preview) {
+ 				printf("<tr><td>Scheduling disable of host <b>%s</b> test <b>%s</b> at <b>%s</b>: %s</td></tr>\n", 
+-					hostname, disabletest[i], ctime(&schedtime), ((result == BB_OK) ? "OK" : "Failed"));
++					htmlquoted(hostname), htmlquoted(disabletest[i]), ctime(&schedtime), ((result == BB_OK) ? "OK" : "Failed"));
+ 			}
+ 		}
+ 		break;
+Index: xymon-4.3.0~beta2.dfsg/web/hobbit-nkedit.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbit-nkedit.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbit-nkedit.c	2013-01-15 10:29:05.789869623 +0700
+@@ -231,7 +231,7 @@
+ 	if (rec) sethostenv_nkedit(rec->updinfo, rec->priority, rec->ttgroup, rec->starttime, rec->endtime, rec->nktime, rec->ttextra);
+ 	else sethostenv_nkedit("", 0, NULL, 0, 0, NULL, NULL);
+ 
+-	sethostenv(hostname, "", service, colorname(COL_BLUE), NULL);
++	sethostenv(htmlquoted(hostname), "", htmlquoted(service), colorname(COL_BLUE), NULL);
+ 
+ 	*warnmsg = '\0';
+ 	if (!rec && nodatawarning) sprintf(warnmsg, "<SCRIPT LANGUAGE=\"Javascript\" type=\"text/javascript\"> alert('%s'); </SCRIPT>\n", nodatawarning);
+Index: xymon-4.3.0~beta2.dfsg/web/bb-eventlog.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-eventlog.c	2009-02-16 19:16:03.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-eventlog.c	2013-01-15 10:34:26.261875057 +0700
+@@ -337,9 +337,9 @@
+ 	parse_query();
+ 
+ 	if ((*periodstring == '\0') && (fromtime || totime)) {
+-		if (fromtime && totime) sprintf(periodstring, "Events between %s - %s", fromtime, totime);
+-		else if (fromtime) sprintf(periodstring, "Events since %s", fromtime);
+-		else if (totime) sprintf(periodstring, "Events until %s", totime);
++		if (fromtime && totime) sprintf(periodstring, "Events between %s - %s", htmlquoted(fromtime), htmlquoted(totime));
++		else if (fromtime) sprintf(periodstring, "Events since %s", htmlquoted(fromtime));
++		else if (totime) sprintf(periodstring, "Events until %s", htmlquoted(totime));
+ 	}
+ 
+ 	/* Now generate the webpage */
+Index: xymon-4.3.0~beta2.dfsg/web/bb-findhost.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-findhost.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-findhost.c	2013-01-15 10:35:59.465876637 +0700
+@@ -163,7 +163,7 @@
+ 		regerror(re_status, &re, re_errstr, BUFSIZE);
+ 
+ 		print_header();
+-		printf("<tr><td align=left><font color=red>%s</font></td>\n",  pSearchPat);
++		printf("<tr><td align=left><font color=red>%s</font></td>\n",  htmlquoted(pSearchPat));
+ 		printf("<td align=left><font color=red>%s</font></td></tr>\n", re_errstr);
+ 		print_footer();
+ 
+@@ -254,7 +254,7 @@
+ 
+ 	print_header();
+ 	if (!gotany) {
+-		printf("<tr><td align=left>%s</td><td align=left>Not found</td></tr>\n", pSearchPat);
++		printf("<tr><td align=left>%s</td><td align=left>Not found</td></tr>\n", htmlquoted(pSearchPat));
+ 	}
+ 	else {
+ 		printf("%s", grabstrbuffer(outbuf));
+Index: xymon-4.3.0~beta2.dfsg/web/bb-hist.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-hist.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-hist.c	2013-01-15 10:38:32.305879224 +0700
+@@ -510,14 +510,14 @@
+ 		      int entrycount,			/* Log entry maxcount */
+ 		      replog_t *loghead)		/* Eventlog for entrycount events back */
+ {
+-	sethostenv(displayname, ip, service, colorname(COL_GREEN), hostname);
++	sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(COL_GREEN), htmlquoted(hostname));
+ 	headfoot(htmlrep, "hist", "", "header", COL_GREEN);
+ 
+ 	fprintf(htmlrep, "\n");
+ 	fprintf(htmlrep, "<CENTER>\n");
+ 	if (wantserviceid) {
+ 		fprintf(htmlrep, "<BR><FONT %s><B>%s - %s</B></FONT><BR>\n", 
+-			xgetenv("MKBBROWFONT"), displayname, service);
++			xgetenv("MKBBROWFONT"), htmlquoted(displayname), htmlquoted(service));
+ 	}
+ 
+ 	/* Create the color-bars */
+Index: xymon-4.3.0~beta2.dfsg/web/bb-rep.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-rep.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-rep.c	2013-01-15 10:40:43.105881441 +0700
+@@ -288,7 +288,7 @@
+ 		strftime(endstr, sizeof(endstr), "%b %d %Y", localtime(&endtime));
+ 		printf("<CENTER><A NAME=begindata>&nbsp;</A>\n");
+ 		printf("<BR><BR><BR><BR>\n");
+-		printf("<H3>Generating report for the period: %s - %s (%s)<BR>\n", startstr, endstr, style);
++		printf("<H3>Generating report for the period: %s - %s (%s)<BR>\n", htmlquoted(startstr), htmlquoted(endstr), htmlquoted(style));
+ 		printf("<P><P>\n");
+ 		fflush(stdout);
+ 	}
+Index: xymon-4.3.0~beta2.dfsg/web/hobbitgraph.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbitgraph.c	2009-02-17 18:53:17.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbitgraph.c	2013-01-15 10:45:19.653886128 +0700
+@@ -640,9 +640,9 @@
+ 	switch (action) {
+ 	  case ACT_MENU:
+ 		fprintf(output, "  <td align=\"left\"><img src=\"%s&amp;action=view&amp;graph=%s\" alt=\"%s graph\"></td>\n",
+-			uri, grtype, grtype);
++			uri, htmlquoted(grtype), htmlquoted(grtype));
+ 		fprintf(output, "  <td align=\"left\" valign=\"top\"> <a href=\"%s&amp;graph=%s&amp;action=selzoom&amp;color=%s\"> <img src=\"%s/zoom.gif\" border=0 alt=\"Zoom graph\" style='padding: 3px'> </a> </td>\n",
+-			uri, grtype, colorname(bgcolor), getenv("BBSKIN"));
++			uri, htmlquoted(grtype), colorname(bgcolor), getenv("BBSKIN"));
+ 		break;
+ 
+ 	  case ACT_SELZOOM:
+@@ -650,7 +650,7 @@
+ 		if (graphstart == 0) gstart = gend - persecs; else gstart = graphstart;
+ 
+ 		fprintf(output, "  <td align=\"left\"><img id='zoomGraphImage' src=\"%s&amp;graph=%s&amp;action=view&amp;graph_start=%u&amp;graph_end=%u&amp;graph_height=%d&amp;graph_width=%d&amp;",
+-			uri, grtype, (int) gstart, (int) gend, graphheight, graphwidth);
++			uri, htmlquoted(grtype), (int) gstart, (int) gend, graphheight, graphwidth);
+ 		if (haveupperlimit) fprintf(output, "&amp;upper=%f", upperlimit);
+ 		if (havelowerlimit) fprintf(output, "&amp;lower=%f", lowerlimit);
+ 		fprintf(output, "\" alt=\"Zoom source image\"></td>\n");
+@@ -700,7 +700,7 @@
+ {
+ 	/* This is special-handled, because we just want to generate an HTML link page */
+ 	fprintf(stdout, "Content-type: %s\n\n", xgetenv("HTMLCONTENTTYPE"));
+-	sethostenv(displayname, "", service, colorname(bgcolor), hostname);
++	sethostenv(htmlquoted(displayname), "", htmlquoted(service), colorname(bgcolor), htmlquoted(hostname));
+ 	sethostenv_backsecs(backsecs);
+ 
+ 	headfoot(stdout, "graphs", "", "header", bgcolor);
+@@ -882,7 +882,7 @@
+ 			char msg[8192];
+ 
+ 			snprintf(msg, sizeof(msg), "hobbitgraph.cfg error, PCRE pattern %s invalid: %s, offset %d\n",
+-				 gdef->fnpat, errmsg, errofs);
++				 htmlquoted(gdef->fnpat), errmsg, errofs);
+ 			errormsg(msg);
+ 		}
+ 		if (gdef->exfnpat) {
+@@ -892,7 +892,7 @@
+ 
+ 				snprintf(msg, sizeof(msg), 
+ 					 "hobbitgraph.cfg error, PCRE pattern %s invalid: %s, offset %d\n",
+-					 gdef->exfnpat, errmsg, errofs);
++					 htmlquoted(gdef->exfnpat), errmsg, errofs);
+ 				errormsg(msg);
+ 			}
+ 		}
+@@ -1130,7 +1130,7 @@
+ void generate_zoompage(char *selfURI)
+ {
+ 	fprintf(stdout, "Content-type: %s\n\n", xgetenv("HTMLCONTENTTYPE"));
+-	sethostenv(displayname, "", service, colorname(bgcolor), hostname);
++	sethostenv(htmlquoted(displayname), "", htmlquoted(service), colorname(bgcolor), htmlquoted(hostname));
+ 	headfoot(stdout, "graphs", "", "header", bgcolor);
+ 
+ 
+Index: xymon-4.3.0~beta2.dfsg/web/bb-snapshot.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/bb-snapshot.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/bb-snapshot.c	2013-01-15 10:47:11.717888027 +0700
+@@ -218,7 +218,7 @@
+ 		strftime(startstr, sizeof(startstr), "%b %d %Y", localtime(&starttime));
+ 		printf("<CENTER><A NAME=begindata>&nbsp;</A>\n");
+ 		printf("<BR><BR><BR><BR>\n");
+-		printf("<H3>Generating snapshot: %s<BR>\n", startstr);
++		printf("<H3>Generating snapshot: %s<BR>\n", htmlquoted(startstr));
+ 		printf("<P><P>\n");
+ 		fflush(stdout);
+ 	}
+Index: xymon-4.3.0~beta2.dfsg/web/hobbit-statusreport.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbit-statusreport.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbit-statusreport.c	2013-01-15 10:51:02.117891927 +0700
+@@ -129,7 +129,7 @@
+ 	if (!embedded) {
+ 		printf("Content-type: %s\n\n", xgetenv("HTMLCONTENTTYPE"));
+ 
+-		printf("<html><head><title>%s</title></head>\n", heading);
++		printf("<html><head><title>%s</title></head>\n", htmlquoted(heading));
+ 		printf("<body>");
+ 		printf("<table border=1 cellpadding=5><tr><th>%s</th><th align=left>Status</th></tr>\n",
+ 		       (showcolumn ? "Host/Column" : "Host"));
+@@ -157,16 +157,16 @@
+ 			printf("<tr><td align=left valign=top><b>");
+ 
+ 			if (addlink) 
+-				printf("<a href=\"%s\">%s</a>", hostsvcurl(hostname, xgetenv("INFOCOLUMN"), 1), hostname);
++				printf("<a href=\"%s\">%s</a>", hostsvcurl(hostname, xgetenv("INFOCOLUMN"), 1), htmlquoted(hostname));
+ 			else 
+-				printf("%s", hostname);
++				printf("%s", htmlquoted(hostname));
+ 
+ 			if (showcolumn) {
+ 				printf("<br>");
+ 				if (addlink) 
+-					printf("<a href=\"%s\">%s</a>", hostsvcurl(hostname, testname, 1), testname);
++					printf("<a href=\"%s\">%s</a>", hostsvcurl(hostname, testname, 1), htmlquoted(testname));
+ 				else
+-					printf("%s", testname);
++					printf("%s", htmlquoted(testname));
+ 			}
+ 
+ 			if (showcolors) printf("&nbsp;-&nbsp;%s", colorstr);
+Index: xymon-4.3.0~beta2.dfsg/web/hobbitsvc.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbitsvc.c	2009-02-19 19:04:58.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbitsvc.c	2013-01-15 10:56:30.809897493 +0700
+@@ -139,10 +139,10 @@
+ 		char *p, *req;
+ 
+ 		req = getenv("SCRIPT_NAME");
+-		clienturi = (char *)malloc(strlen(req) + 10 + strlen(hostname));
++		clienturi = (char *)malloc(strlen(req) + 10 + strlen(htmlquoted(hostname)));
+ 		strcpy(clienturi, req);
+ 		p = strchr(clienturi, '?'); if (p) *p = '\0'; else p = clienturi + strlen(clienturi);
+-		sprintf(p, "?CLIENT=%s", hostname);
++		sprintf(p, "?CLIENT=%s", htmlquoted(hostname));
+ 	}
+ 
+ 	return 0;
+@@ -240,7 +240,7 @@
+ 	else if ((strcmp(service, xgetenv("TRENDSCOLUMN")) == 0) || (strcmp(service, xgetenv("INFOCOLUMN")) == 0)) {
+ 		if (loadhostdata(hostname, &ip, &displayname, &compacts) != 0) return 1;
+ 		ishtmlformatted = 1;
+-		sethostenv(displayname, ip, service, colorname(COL_GREEN), hostname);
++		sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(COL_GREEN), htmlquoted(hostname));
+ 		sethostenv_refresh(600);
+ 		color = COL_GREEN;
+ 		logtime = getcurrenttime(NULL);
+@@ -383,7 +383,7 @@
+ 			displayname = ((items[16]  && *items[16]) ? items[16] : hostname);
+ 			clntstamp = ((items[17]  && *items[17]) ? atol(items[17]) : 0);
+ 
+-			sethostenv(displayname, ip, service, colorname(COL_GREEN), hostname);
++			sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(COL_GREEN), htmlquoted(hostname));
+ 			sethostenv_refresh(60);
+ 		}
+ 		else {
+@@ -414,7 +414,7 @@
+ 				if (icolor > color) color = icolor;
+ 
+ 				sprintf(l, "<tr><td align=left>&%s&nbsp;<a href=\"%s\">%s</a></td></tr>\n", 
+-					itmcolor, hostsvcurl(hostname, testname, 1), testname);
++					itmcolor, hostsvcurl(hostname, testname, 1), htmlquoted(testname));
+ 				addtobuffer(cmsg, l);
+ 				row = strtok_r(NULL, "\n", &p_row);
+ 			}
+@@ -422,7 +422,7 @@
+ 			addtobuffer(cmsg, "</table>\n");
+ 			ishtmlformatted = 1;
+ 
+-			sethostenv(displayname, ip, service, colorname(color), hostname);
++			sethostenv(htmlquoted(displayname), htmlquoted(ip), htmlquoted(service), colorname(color), htmlquoted(hostname));
+ 			sethostenv_refresh(60);
+ 			logtime = getcurrenttime(NULL);
+ 			strcpy(timesincechange, "0 minutes");
+@@ -549,9 +549,9 @@
+ 					errprintf("Cannot find hostdata files for host %s\n", hostname);
+ 				}
+ 				else {
+-					clienturi = (char *)malloc(strlen(cgiurl) + 20 + strlen(hostname));
++					clienturi = (char *)malloc(strlen(cgiurl) + 20 + strlen(htmlquoted(hostname)));
+ 					sprintf(clienturi, "%s/bb-hostsvc.sh?CLIENT=%s&amp;TIMEBUF=%s", 
+-						cgiurl, hostname, clientid);
++						cgiurl, htmlquoted(hostname), clientid);
+ 				}
+ 			}
+ 			else {
+Index: xymon-4.3.0~beta2.dfsg/web/hobbitsvc-info.c
+===================================================================
+--- xymon-4.3.0~beta2.dfsg.orig/web/hobbitsvc-info.c	2009-02-12 20:09:34.000000000 +0700
++++ xymon-4.3.0~beta2.dfsg/web/hobbitsvc-info.c	2013-01-15 11:04:34.461905691 +0700
+@@ -225,7 +225,7 @@
+ 	char l[1024];
+ 	int i, rcount;
+ 
+-	sprintf(l, "<table summary=\"%s Alerts\" border=1>\n", hostname);
++	sprintf(l, "<table summary=\"%s Alerts\" border=1>\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 	addtobuffer(buf, "<tr><th>Service</th><th>Recipient</th><th>1st Delay</th><th>Stop after</th><th>Repeat</th><th>Time of Day</th><th>Colors</th></tr>\n");
+ 
+@@ -272,7 +272,7 @@
+ 
+ 	holidayset = bbh_item(hi, BBH_HOLIDAYS);
+ 
+-	sprintf(l, "<table summary=\"%s Holidays\" border=1>\n", hostname);
++	sprintf(l, "<table summary=\"%s Holidays\" border=1>\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 
+ 	addtobuffer(buf, "<tr>");
+@@ -450,7 +450,7 @@
+ 
+ 	sprintf(l, "<form name=\"disableform\" method=\"post\" action=\"%s/hobbit-enadis.sh\">\n", xgetenv("SECURECGIBINURL"));
+ 	addtobuffer(buf, l);
+-	sprintf(l, "<table summary=\"%s disable\" border=1>\n", hostname);
++	sprintf(l, "<table summary=\"%s disable\" border=1>\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 
+ 	addtobuffer(buf, "<tr>\n");
+@@ -562,7 +562,7 @@
+ 
+ 	addtobuffer(buf, "</table>\n");
+ 
+-	sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", hostname);
++	sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 	addtobuffer(buf, "</form>\n");
+ }
+@@ -573,7 +573,7 @@
+ 	char l[1024];
+ 	char *msg, *eoln;
+ 
+-	sprintf(l, "<table summary=\"%s disabled tests\" border=1>\n", hostname);
++	sprintf(l, "<table summary=\"%s disabled tests\" border=1>\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 
+ 	addtobuffer(buf, "<tr><th>Test</th><th>Disabled until</th><th>Cause</th><th>&nbsp;</th></tr>\n");
+@@ -594,17 +594,17 @@
+ 		addtobuffer(buf, "<td>");
+ 		while ((eoln = strchr(msg, '\n')) != NULL) {
+ 			*eoln = '\0';
+-			addtobuffer(buf, msg);
++			addtobuffer(buf, htmlquoted(msg));
+ 			addtobuffer(buf, "<br>");
+ 			msg = (eoln + 1);
+ 		}
+-		addtobuffer(buf, msg);
++		addtobuffer(buf, htmlquoted(msg));
+ 		addtobuffer(buf, "</td>\n");
+ 
+ 		addtobuffer(buf, "<td>");
+ 		sprintf(l, "<form method=\"post\" action=\"%s/hobbit-enadis.sh\">\n", xgetenv("SECURECGIBINURL"));
+ 		addtobuffer(buf, l);
+-		sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", hostname);
++		sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", htmlquoted(hostname));
+ 		addtobuffer(buf, l);
+ 		sprintf(l, "<input name=\"enabletest\" type=hidden value=\"%s\">\n", tnames[i].name);
+ 		addtobuffer(buf, l);
+@@ -620,7 +620,7 @@
+ 	addtobuffer(buf, "<td>");
+ 	sprintf(l, "<form method=\"post\" action=\"%s/hobbit-enadis.sh\">\n", xgetenv("SECURECGIBINURL"));
+ 	addtobuffer(buf, l);
+-	sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", hostname);
++	sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 	sprintf(l, "<input name=\"enabletest\" type=hidden value=\"%s\">\n", "*");
+ 	addtobuffer(buf, l);
+@@ -640,7 +640,7 @@
+ 	sched_t *swalk;
+ 	char *msg, *eoln;
+ 
+-	sprintf(l, "<table summary=\"%s scheduled disables\" border=1>\n", hostname);
++	sprintf(l, "<table summary=\"%s scheduled disables\" border=1>\n", htmlquoted(hostname));
+ 	addtobuffer(buf, l);
+ 
+ 	addtobuffer(buf, "<tr><th>ID</th><th>When</th><th>Command</th><th>&nbsp;</th></tr>\n");
+@@ -658,17 +658,17 @@
+ 		addtobuffer(buf, "<td>");
+ 		while ((eoln = strchr(msg, '\n')) != NULL) {
+ 			*eoln = '\0';
+-			addtobuffer(buf, msg);
++			addtobuffer(buf, htmlquoted(msg));
+ 			addtobuffer(buf, "<br>");
+ 			msg = (eoln + 1);
+ 		}
+-		addtobuffer(buf, msg);
++		addtobuffer(buf, htmlquoted(msg));
+ 		addtobuffer(buf, "</td>\n");
+ 
+ 		addtobuffer(buf, "<td>");
+ 		sprintf(l, "<form method=\"post\" action=\"%s/hobbit-enadis.sh\">\n", xgetenv("SECURECGIBINURL"));
+ 		addtobuffer(buf, l);
+-		sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", hostname);
++		sprintf(l, "<input name=\"hostname\" type=hidden value=\"%s\">\n", htmlquoted(hostname));
+ 		addtobuffer(buf, l);
+ 		sprintf(l, "<input name=\"canceljob\" type=hidden value=\"%d\">\n", swalk->id);
+ 		addtobuffer(buf, l);
+@@ -720,10 +720,10 @@
+ 	val = bbh_item(hostwalk, BBH_DISPLAYNAME);
+ 	if (val && (strcmp(val, hostname) != 0)) {
+ 		sprintf(l, "<tr><th align=left>Hostname:</th><td align=left>%s (%s)</td></tr>\n", 
+-			val, hostname);
++			val, htmlquoted(hostname));
+ 	}
+ 	else {
+-		sprintf(l, "<tr><th align=left>Hostname:</th><td align=left>%s</td></tr>\n", hostname);
++		sprintf(l, "<tr><th align=left>Hostname:</th><td align=left>%s</td></tr>\n", htmlquoted(hostname));
+ 	}
+ 	addtobuffer(infobuf, l);
+