Fix #17870: XSS in adm_config_report.php