diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:35:57 -0300 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:42:49 -0300 |
| commit | e41ec5848f21015068255c1d61d01edf442e8e7e (patch) | |
| tree | 45c3214c1e3d638dbacb217cd3de95fb4aa6e770 /usr/local/www/firewall_virtual_ip.php | |
| parent | 49f3f28fea92114b09d3b2d8103398c4adcb3635 (diff) | |
| download | pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.zip pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.tar.gz | |
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print
Diffstat (limited to 'usr/local/www/firewall_virtual_ip.php')
| -rwxr-xr-x | usr/local/www/firewall_virtual_ip.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr/local/www/firewall_virtual_ip.php b/usr/local/www/firewall_virtual_ip.php index b081c46..7d17938 100755 --- a/usr/local/www/firewall_virtual_ip.php +++ b/usr/local/www/firewall_virtual_ip.php @@ -190,7 +190,7 @@ if ($_GET['act'] == "del") { exit; } } -} else if ($_GET['changes'] == "mods") +} else if ($_GET['changes'] == "mods" && is_numericint($_GET['id'])) $id = $_GET['id']; $pgtitle = array(gettext("Firewall"),gettext("Virtual IP Addresses")); @@ -222,7 +222,7 @@ include("head.inc"); ?> </td></tr> <tr> - <td><input type="hidden" id="id" name="id" value="<?php echo $id; ?>" /></td> + <td><input type="hidden" id="id" name="id" value="<?php echo htmlspecialchars($id); ?>" /></td> </tr> <tr> <td> |
