summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRenato Botelho <garga@FreeBSD.org>2014-06-19 11:29:18 -0300
committerRenato Botelho <garga@FreeBSD.org>2014-06-19 11:30:38 -0300
commitbef1056048aa2e0839fd5839e83da154f06c8c2c (patch)
tree6d6ea5a62a45c82428bacb80d7530205a6790913
parentdaeab6c45370e05491ae60f854fb3b9967c6f94d (diff)
downloadpfsense-bef1056048aa2e0839fd5839e83da154f06c8c2c.zip
pfsense-bef1056048aa2e0839fd5839e83da154f06c8c2c.tar.gz
Make sure single quotes are encoded and avoid javascript injection
-rw-r--r--usr/local/www/exec.php4
1 files changed, 2 insertions, 2 deletions
diff --git a/usr/local/www/exec.php b/usr/local/www/exec.php
index b95b72b..1963508 100644
--- a/usr/local/www/exec.php
+++ b/usr/local/www/exec.php
@@ -108,8 +108,8 @@ if (isBlank( $_POST['txtRecallBuffer'] )) {
puts( " var arrRecallBuffer = new Array(" );
$arrBuffer = explode( "&", $_POST['txtRecallBuffer'] );
for ($i=0; $i < (count( $arrBuffer ) - 1); $i++)
- puts( " '" . htmlspecialchars($arrBuffer[$i]) . "'," );
- puts( " '" . htmlspecialchars($arrBuffer[count( $arrBuffer ) - 1]) . "'" );
+ puts( " '" . htmlspecialchars($arrBuffer[$i], ENT_QUOTES | ENT_HTML401) . "'," );
+ puts( " '" . htmlspecialchars($arrBuffer[count( $arrBuffer ) - 1], ENT_QUOTES | ENT_HTML401) . "'" );
puts( " );" );
}
OpenPOWER on IntegriCloud