From 48af67bd00b77ef4b10dac6eef1c7708645282e2 Mon Sep 17 00:00:00 2001
From: Ollama <ollama@steganos.dev>
Date: Sat, 14 Mar 2026 15:30:52 +0000
Subject: [PATCH] Fix stored XSS in gcaptcha_site_key on login page

---
 app/Views/login.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Views/login.php b/app/Views/login.php
index d665c0677..b7c32ce45 100644
--- a/app/Views/login.php
+++ b/app/Views/login.php
@@ -92,7 +92,7 @@
                 <?php
                 if ($gcaptcha_enabled) {
                     echo '<script src="https://www.google.com/recaptcha/api.js"></script>';
-                    echo '<div class="g-recaptcha mb-3" style="text-align: center;" data-sitekey="' . $config['gcaptcha_site_key'] . '"></div>';
+                    echo '<div class="g-recaptcha mb-3" style="text-align: center;" data-sitekey="' . esc($config['gcaptcha_site_key']) . '"></div>';
                 }
                 ?>
                 <div class="d-grid">