summaryrefslogtreecommitdiffstats
path: root/usr/local/www/services_dhcpv6_edit.php
diff options
context:
space:
mode:
authorRenato Botelho <garga@FreeBSD.org>2014-03-12 11:35:57 -0300
committerRenato Botelho <garga@FreeBSD.org>2014-03-12 11:42:49 -0300
commite41ec5848f21015068255c1d61d01edf442e8e7e (patch)
tree45c3214c1e3d638dbacb217cd3de95fb4aa6e770 /usr/local/www/services_dhcpv6_edit.php
parent49f3f28fea92114b09d3b2d8103398c4adcb3635 (diff)
downloadpfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.zip
pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.tar.gz
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print
Diffstat (limited to 'usr/local/www/services_dhcpv6_edit.php')
-rw-r--r--usr/local/www/services_dhcpv6_edit.php5
1 files changed, 3 insertions, 2 deletions
diff --git a/usr/local/www/services_dhcpv6_edit.php b/usr/local/www/services_dhcpv6_edit.php
index 32ac04a..40f71ca 100644
--- a/usr/local/www/services_dhcpv6_edit.php
+++ b/usr/local/www/services_dhcpv6_edit.php
@@ -82,8 +82,9 @@ $ifcfgipv6 = get_interface_ipv6($if);
$ifcfgsnv6 = get_interface_subnetv6($if);
$ifcfgdescr = convert_friendly_interface_to_friendly_descr($if);
-$id = $_GET['id'];
-if (isset($_POST['id']))
+if (is_numericint($_GET['id']))
+ $id = $_GET['id'];
+if (isset($_POST['id']) && is_numericint($_POST['id']))
$id = $_POST['id'];
if (isset($id) && $a_maps[$id]) {
OpenPOWER on IntegriCloud