From d6474a2f975cf42eab8d7c17a49c77ecdc93c03f Mon Sep 17 00:00:00 2001
From: Stefano Pigozzi <ste.pigozzi@gmail.com>
Date: Thu, 7 Jun 2018 11:59:15 +0200
Subject: [PATCH] Prevent injections

---
 webserver.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webserver.py b/webserver.py
index 020d71de..90ace384 100644
--- a/webserver.py
+++ b/webserver.py
@@ -109,7 +109,7 @@ def page_setcss():
             abort(403)
             return
         css = request.form.get("css", "")
-        if "<style" in css:
+        if "</style" in css:
             abort(400)
             return
         if ccss is None: