* guiconfig.inc comes first

* use escapeshellarg()

1 files changed, 4 insertions, 4 deletions

diff --git a/usr/local/www/diag_logs_filter.php b/usr/local/www/diag_logs_filter.php
index 5430333..2441f27 100755
--- a/usr/local/www/diag_logs_filter.php
+++ b/usr/local/www/diag_logs_filter.php
@@ -30,18 +30,18 @@
 	POSSIBILITY OF SUCH DAMAGE.
 */
 
+require("guiconfig.inc");
+
 if($_GET['getrulenum'] or $_POST['getrulenum']) {
 	if($_GET['getrulenum'])
-		$rulenum = $_GET['getrulenum'];
+		$rulenum = escapeshellarg($_GET['getrulenum']);
 	if($_POST['getrulenum'])
-		$rulenum = $_POST['getrulenum'];
+		$rulenum = escapeshellarg($_POST['getrulenum']);
 	$rule = `pfctl -vvsr | grep @{$rulenum}`;
 	echo "The rule that triggered this action is:\n\n{$rule}";
 	exit;
 }
 
-require("guiconfig.inc");
-
 $filter_logfile = "{$g['varlog_path']}/filter.log";
 
 $nentries = $config['syslog']['nentries'];