Fix #6278

$cpzone is always in lowercase, it's used as the array key used in
config.xml. Use it in two cases where the $cp['zone'] was being wrongly
used:

- To find out zoneid
- To replace PORTAL_ACTION url

1 files changed, 3 insertions, 3 deletions

diff --git a/src/etc/inc/captiveportal.inc b/src/etc/inc/captiveportal.inc
index 9e3d6e2..dfa9e3c 100644
--- a/src/etc/inc/captiveportal.inc
+++ b/src/etc/inc/captiveportal.inc
@@ -1489,7 +1489,7 @@ function captiveportal_opendb() {
 			if (!is_numericint($cpzoneid)) {
 				if (is_array($config['captiveportal'])) {
 					foreach ($config['captiveportal'] as $cpkey => $cp) {
-						if ($cpzone == $cp['zone']) {
+						if ($cpzone == $cpkey) {
 							$cpzoneid = $cp['zoneid'];
 						}
 					}
@@ -1956,8 +1956,8 @@ function portal_reply_page($redirurl, $type = null, $message = null, $clientmac
 	/* substitute other variables */
 	$ourhostname = portal_hostname_from_client_ip($clientip);
 	$protocol = (isset($cpcfg['httpslogin'])) ? 'https://' : 'http://';
-	$htmltext = str_replace("\$PORTAL_ACTION\$", "{$protocol}{$ourhostname}/index.php?zone={$cpcfg['zone']}", $htmltext);
-	$htmltext = str_replace("#PORTAL_ACTION#", "{$protocol}{$ourhostname}/index.php?zone={$cpcfg['zone']}", $htmltext);
+	$htmltext = str_replace("\$PORTAL_ACTION\$", "{$protocol}{$ourhostname}/index.php?zone={$cpzone}", $htmltext);
+	$htmltext = str_replace("#PORTAL_ACTION#", "{$protocol}{$ourhostname}/index.php?zone={$cpzone}", $htmltext);
 
 	$htmltext = str_replace("\$PORTAL_ZONE\$", htmlspecialchars($cpzone), $htmltext);
 	$htmltext = str_replace("\$PORTAL_REDIRURL\$", htmlspecialchars($redirurl), $htmltext);