From 4619447dcae329ea636eefd70681443ea33ced6a Mon Sep 17 00:00:00 2001
From: Zack Spear <zackspear@users.noreply.github.com>
Date: Wed, 25 Jun 2025 13:43:31 -0700
Subject: [PATCH] fix: balance_status sanitize output

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 emhttp/plugins/dynamix/DeviceInfo.page | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/emhttp/plugins/dynamix/DeviceInfo.page b/emhttp/plugins/dynamix/DeviceInfo.page
index 61c068aad..91e028949 100644
--- a/emhttp/plugins/dynamix/DeviceInfo.page
+++ b/emhttp/plugins/dynamix/DeviceInfo.page
@@ -935,10 +935,9 @@ _(btrfs filesystem usage)_:
 <div>
   <dl>
     <dt><?= _('btrfs balance status') ?>:</dt>
-    <dd><pre id='btrfs-balance'><?= implode("\n", $balance_status) ?></pre></dd>
+    <dd><pre id='btrfs-balance'><?= htmlspecialchars(implode("\n", $balance_status), ENT_QUOTES, 'UTF-8') ?></pre></dd>
   </dl>
 </div>
-
 <?if ($retval != 0):?>
 <input type="hidden" name="#command" value="/webGui/scripts/btrfs_balance">
 <input type="hidden" name="#arg[1]" value="start">