diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2014-11-20 10:25:28 -0200 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2014-11-20 10:25:38 -0200 |
| commit | 3bdc7f5908ad19af2fc31b873cd07eadeb801bd5 (patch) | |
| tree | 434c2f28998849fb53f0539661fc5d9bec274d74 /usr/local/www/installer | |
| parent | dd34d7d239d823921237c4408559e674f5f0c292 (diff) | |
| download | pfsense-3bdc7f5908ad19af2fc31b873cd07eadeb801bd5.zip pfsense-3bdc7f5908ad19af2fc31b873cd07eadeb801bd5.tar.gz | |
Remove debugging code that can lead us to XSS injection, also pass variables through htmlspecialchars() to sanitize
Diffstat (limited to 'usr/local/www/installer')
| -rw-r--r-- | usr/local/www/installer/installer.php | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/usr/local/www/installer/installer.php b/usr/local/www/installer/installer.php index e2ae09c..05f10b9 100644 --- a/usr/local/www/installer/installer.php +++ b/usr/local/www/installer/installer.php @@ -497,7 +497,7 @@ function verify_before_install() { } if(!$bootmanager) $bootmanager = $_REQUEST['bootmanager']; - echo "\n<!--" . print_r($_REQUEST, true) . " -->\n"; + // echo "\n<!--" . print_r($_REQUEST, true) . " -->\n"; $disk = pcsysinstall_get_disk_info(htmlspecialchars($_REQUEST['disk'])); $disksize = format_bytes($disk['size'] * 1048576); // Loop through posted items and create an array @@ -535,7 +535,7 @@ function verify_before_install() { $tmparray['encpass'] = $_REQUEST['encpass' . $x]; $disks[] = $tmparray; } - echo "\n<!-- " . print_r($disks, true) . " --> \n"; + // echo "\n<!-- " . print_r($disks, true) . " --> \n"; $bootmanagerupper = strtoupper($bootmanager); echo <<<EOFAMBAC <form method="post" action="installer.php"> @@ -595,11 +595,11 @@ EOFAMBACBAF; foreach($disks as $disk) { $desc = pcsysinstall_get_disk_info($disk['disk']); echo "<tr>"; - echo "<td> {$disk['mountpoint']}</td>"; - echo "<td>{$disk['fstype']}</td>"; - echo "<td>{$disk['disk']} {$desc['desc']}</td>"; - echo "<td>{$disk['size']}</td>"; - echo "<td>{$disk['encpass']}</td>"; + echo "<td> " . htmlspecialchars($disk['mountpoint']) . "</td>"; + echo "<td>" . htmlspecialchars($disk['fstype']) . "</td>"; + echo "<td>" . htmlspecialchars($disk['disk']) . " " . htmlspecialchars($desc['desc']) . "</td>"; + echo "<td>" . htmlspecialchars($disk['size']) . "</td>"; + echo "<td>" . htmlspecialchars($disk['encpass']) . "</td>"; echo "</tr>"; } @@ -970,7 +970,7 @@ EOF; $first_disk_size = $size - $swap_size; // Debugging - echo "\n\n<!-- $first_disk - " . print_r($disk_info, true) . " - $size - $first_disk_size -->\n\n"; + // echo "\n\n<!-- $first_disk - " . print_r($disk_info, true) . " - $size - $first_disk_size -->\n\n"; // Check to see if a on disk layout exists if(file_exists("/tmp/webInstaller_disk_layout.txt")) { |
