The regex was unanchored: `/[^<>;"]/` matched on the first character that was
not one of those four, so `evil<script>` passed. Output is escaped on render
anyway.
Its only caller is the client field in group management, which takes a host
name or an interface like `:eth0`. FTL matches both verbatim and only records
names of `[A-Za-z0-9._-]`, so we check exactly that.
Signed-off-by: DL6ER <dl6er@dl6er.de>
DL6ER
e92e6b837b