EZP-22539: XSS in admin interface