diff options
author | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:35:57 -0300 |
---|---|---|
committer | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:42:32 -0300 |
commit | 0e6cf71b17cc57c40aebc64359c1a27e2515b7b7 (patch) | |
tree | 8e409a77838a21da4644e4d3f39d05acf17a4952 /usr/local/www/services_captiveportal_vouchers.php | |
parent | 3b77ba4a2a96a388682d564c3b9b7517bbbfdb21 (diff) | |
download | pfsense-0e6cf71b17cc57c40aebc64359c1a27e2515b7b7.zip pfsense-0e6cf71b17cc57c40aebc64359c1a27e2515b7b7.tar.gz |
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print
Diffstat (limited to 'usr/local/www/services_captiveportal_vouchers.php')
-rw-r--r-- | usr/local/www/services_captiveportal_vouchers.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr/local/www/services_captiveportal_vouchers.php b/usr/local/www/services_captiveportal_vouchers.php index a7edc3d..9fecd0e 100644 --- a/usr/local/www/services_captiveportal_vouchers.php +++ b/usr/local/www/services_captiveportal_vouchers.php @@ -629,7 +629,7 @@ function enable_change(enable_change) { <tr> <td width="22%" valign="top"> </td> <td width="78%"> - <input type="hidden" name="zone" id="zone" value="<?=$cpzone;?>" /> + <input type="hidden" name="zone" id="zone" value="<?=htmlspecialchars($cpzone);?>" /> <input type="hidden" name="exponent" id="exponent" value="<?=$pconfig['exponent'];?>" /> <input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" onClick="enable_change(true); before_save();"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()"> |