From 6fdb077ca51407162109c9ed0d97882d7c7138eb Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Tue, 17 Oct 2023 15:25:45 +0200
Subject: [PATCH 1/2] Fixed XSS vulnerability when displaying form error
 messages.

---
 modoboa/templates/common/generic_field.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modoboa/templates/common/generic_field.html b/modoboa/templates/common/generic_field.html
index 95a03f5cb..116071a8f 100644
--- a/modoboa/templates/common/generic_field.html
+++ b/modoboa/templates/common/generic_field.html
@@ -12,7 +12,7 @@
     {% endif %}
   </label>
   {% endif %}
-  
+
   <div class="{% render_field_width field %}">
     {% if appended_text %}
     <div class="input-group">
@@ -31,7 +31,7 @@
     {% if field.errors %}
     <p class="help-block">
       {% for error in field.errors %}
-      {{ error|safe }}
+      {{ error }}
       {% endfor %}
     </p>
     {% endif %}

From 540b27a2319c41682155754dacd7625946f33359 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Wed, 18 Oct 2023 12:16:25 +0200
Subject: [PATCH 2/2] Fixed regression.

---
 modoboa/static/js/twocols_nav.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modoboa/static/js/twocols_nav.js b/modoboa/static/js/twocols_nav.js
index e3574a13e..f862a50d7 100644
--- a/modoboa/static/js/twocols_nav.js
+++ b/modoboa/static/js/twocols_nav.js
@@ -30,7 +30,7 @@ TwocolsNav.prototype = {
     listen: function() {
         $("a.ajaxnav").click($.proxy(this.load_section, this));
         $(document).on("click", "#update", $.proxy(function(e) {
-            var $form = $("form").first();
+            var $form = $(e.target).closest("form");
             simple_ajax_form_post(e, {
                 formid: $form.attr("id"),
                 modal: false,