From e37e84b3d71cc1c281613cf0ea0f2b40d712f611 Mon Sep 17 00:00:00 2001
From: Ming Deng <mingflycash@gmail.com>
Date: Tue, 17 Aug 2021 00:31:41 +0800
Subject: [PATCH] Fix 4727: CSS when the request URI is invalid

---
 CHANGELOG.md             | 1 +
 server/web/admin.go      | 7 ++-----
 server/web/statistics.go | 3 ++-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fef1fb7c..989bcede 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 - Remove `duration` from prometheus labels. [4391](https://github.com/beego/beego/pull/4391)
 - Fix `unknown escape sequence` in generated code. [4385](https://github.com/beego/beego/pull/4385)
 - Fix 4590: Forget to check URL when FilterChain invoke `next()`. [4593](https://github.com/beego/beego/pull/4593)
+- Fix 4727: CSS when request URI is invalid. [4729](https://github.com/beego/beego/pull/4729)
 - Using fixed name `commentRouter.go` as generated file name. [4385](https://github.com/beego/beego/pull/4385)
 - Fix 4383: ORM Adapter produces panic when using orm.RegisterModelWithPrefix. [4386](https://github.com/beego/beego/pull/4386)
 - Fix 4444: panic when 404 not found. [4446](https://github.com/beego/beego/pull/4446)
diff --git a/server/web/admin.go b/server/web/admin.go
index 3f665b09..1d4e5d49 100644
--- a/server/web/admin.go
+++ b/server/web/admin.go
@@ -82,13 +82,10 @@ type adminApp struct {
 	*HttpServer
 }
 
-// Route adds http.HandlerFunc to adminApp with url pattern.
+// Run start Beego admin
 func (admin *adminApp) Run() {
 
-	// if len(task.AdminTaskList) > 0 {
-	// 	task.StartTask()
-	// }
-	logs.Warning("now we don't start tasks here, if you use task module," +
+	logs.Debug("now we don't start tasks here, if you use task module," +
 		" please invoke task.StartTask, or task will not be executed")
 
 	addr := BConfig.Listen.AdminAddr
diff --git a/server/web/statistics.go b/server/web/statistics.go
index 3677271b..42bf9287 100644
--- a/server/web/statistics.go
+++ b/server/web/statistics.go
@@ -16,6 +16,7 @@ package web
 
 import (
 	"fmt"
+	"html/template"
 	"sync"
 	"time"
 
@@ -98,7 +99,7 @@ func (m *URLMap) GetMap() map[string]interface{} {
 	for k, v := range m.urlmap {
 		for kk, vv := range v {
 			result := []string{
-				fmt.Sprintf("% -50s", k),
+				fmt.Sprintf("% -50s", template.HTMLEscapeString(k)),
 				fmt.Sprintf("% -10s", kk),
 				fmt.Sprintf("% -16d", vv.RequestNum),
 				fmt.Sprintf("%d", vv.TotalTime),