diff options
| author | Scott Ullrich <sullrich@pfsense.org> | 2008-02-12 04:40:35 +0000 |
|---|---|---|
| committer | Scott Ullrich <sullrich@pfsense.org> | 2008-02-12 04:40:35 +0000 |
| commit | d8c1a6c53c524714ad61dbcced0040108312a260 (patch) | |
| tree | 6db2c41cf27483aa10c475cc19f0ff219a679296 /usr/local/www/pkg.php | |
| parent | 017648626c9e36526edd3a6212650f431ac16841 (diff) | |
| download | pfsense-d8c1a6c53c524714ad61dbcced0040108312a260.zip pfsense-d8c1a6c53c524714ad61dbcced0040108312a260.tar.gz | |
Make scripts XSS input safe.
Pointed-out: by hoopercharles@gmail.com
Diffstat (limited to 'usr/local/www/pkg.php')
| -rwxr-xr-x | usr/local/www/pkg.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr/local/www/pkg.php b/usr/local/www/pkg.php index 813d338..cdcd431 100755 --- a/usr/local/www/pkg.php +++ b/usr/local/www/pkg.php @@ -39,7 +39,7 @@ function gentitle_pkg($pgname) { return $config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pgname; } -$xml = $_GET['xml']; +$xml = htmlspecialchars($_GET['xml']); if($xml == "") { print_info_box_np(gettext("ERROR: No package defined.")); @@ -107,7 +107,7 @@ include("head.inc"); include("fbegin.inc"); ?> <form action="pkg.php" method="post"> -<? if($_GET['savemsg'] <> "") $savemsg = $_GET['savemsg']; ?> +<? if($_GET['savemsg'] <> "") $savemsg = htmlspecialchars($_GET['savemsg']); ?> <?php if ($savemsg) print_info_box($savemsg); ?> <table width="100%" border="0" cellpadding="0" cellspacing="0"> <?php |
