Goal: Fix possible XSS attack in SWAT

Fixes: Upstream security fix. CVE-2011-2694

Status wrt upstream: Fixed in 3.5.10

Author: Kai Blin <kai@samba.org>

Index: squeeze/source3/web/swat.c
===================================================================
--- squeeze.orig/source3/web/swat.c
+++ squeeze/source3/web/swat.c
@@ -1121,11 +1121,9 @@
 	if(cgi_variable(CHG_S_PASSWD_FLAG)) {
 		printf("<p>");
 		if (rslt == True) {
-			printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
-			printf("\n");
+			printf("%s\n", _(" The passwd has been changed."));
 		} else {
-			printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
-			printf("\n");
+			printf("%s\n", _(" The passwd has NOT been changed."));
 		}
 	}
 	
@@ -1139,14 +1137,6 @@
 {
 	const char *new_name = cgi_user_name();
 
-	/* 
-	 * After the first time through here be nice. If the user
-	 * changed the User box text to another users name, remember it.
-	 */
-	if (cgi_variable(SWAT_USER)) {
-		new_name = cgi_variable_nonull(SWAT_USER);
-	} 
-
 	if (!new_name) new_name = "";
 
 	printf("<H2>%s</H2>\n", _("Server Password Management"));
