diff options
| author | Steve Beaver <sbeaver@netgate.com> | 2017-03-20 12:24:11 -0400 |
|---|---|---|
| committer | Steve Beaver <sbeaver@netgate.com> | 2017-03-20 12:24:11 -0400 |
| commit | 11800cffd5bd0731596324cd4d26f829bf198174 (patch) | |
| tree | 32b3658b441748931ac3ff115b3ef300c702b2ee | |
| parent | 12507f358980be990196596322581a8b8661f4cb (diff) | |
| parent | f95d6bdc1910690eb90b94227626f2db188a69ba (diff) | |
| download | pfsense-11800cffd5bd0731596324cd4d26f829bf198174.zip pfsense-11800cffd5bd0731596324cd4d26f829bf198174.tar.gz | |
Merge pull request #3650 from phil-davis/nat-description
| -rw-r--r-- | src/usr/local/www/firewall_nat_1to1_edit.php | 4 | ||||
| -rw-r--r-- | src/usr/local/www/firewall_nat_edit.php | 4 | ||||
| -rw-r--r-- | src/usr/local/www/firewall_nat_out_edit.php | 4 |
3 files changed, 12 insertions, 0 deletions
diff --git a/src/usr/local/www/firewall_nat_1to1_edit.php b/src/usr/local/www/firewall_nat_1to1_edit.php index e27d433..d16f4ce 100644 --- a/src/usr/local/www/firewall_nat_1to1_edit.php +++ b/src/usr/local/www/firewall_nat_1to1_edit.php @@ -104,6 +104,10 @@ if ($_POST['save']) { * cannot think he is slick and perform a XSS attack on the unwilling */ foreach ($_POST as $key => $value) { + if ($key == 'descr') { + continue; + } + $temp = str_replace(">", "", $value); $newpost = htmlentities($temp); diff --git a/src/usr/local/www/firewall_nat_edit.php b/src/usr/local/www/firewall_nat_edit.php index 83440ba..a77d6c1 100644 --- a/src/usr/local/www/firewall_nat_edit.php +++ b/src/usr/local/www/firewall_nat_edit.php @@ -114,6 +114,10 @@ if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) { unset($input_errors); foreach ($_REQUEST as $key => $value) { + if ($key == 'descr') { + continue; + } + $temp = $value; $newpost = htmlentities($temp); diff --git a/src/usr/local/www/firewall_nat_out_edit.php b/src/usr/local/www/firewall_nat_out_edit.php index 721eb9e..f9579d2 100644 --- a/src/usr/local/www/firewall_nat_out_edit.php +++ b/src/usr/local/www/firewall_nat_out_edit.php @@ -146,6 +146,10 @@ if ($_POST['save']) { * cannot think he is slick and perform a XSS attack on the unwilling */ foreach ($_POST as $key => $value) { + if ($key == 'descr') { + continue; + } + $temp = str_replace(">", "", $value); $newpost = htmlentities($temp); if ($newpost <> $temp) { |
