diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:35:57 -0300 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:42:49 -0300 |
| commit | e41ec5848f21015068255c1d61d01edf442e8e7e (patch) | |
| tree | 45c3214c1e3d638dbacb217cd3de95fb4aa6e770 /usr/local/www/status_captiveportal.php | |
| parent | 49f3f28fea92114b09d3b2d8103398c4adcb3635 (diff) | |
| download | pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.zip pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.tar.gz | |
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print
Diffstat (limited to 'usr/local/www/status_captiveportal.php')
| -rwxr-xr-x | usr/local/www/status_captiveportal.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr/local/www/status_captiveportal.php b/usr/local/www/status_captiveportal.php index d84e9b2..0acbe89 100755 --- a/usr/local/www/status_captiveportal.php +++ b/usr/local/www/status_captiveportal.php @@ -188,7 +188,7 @@ $mac_man = load_mac_manufacturer_table(); <?php endif; ?> <form action="status_captiveportal.php" method="get" style="margin: 14px;"> -<input type="hidden" name="order" value="<?=$_GET['order'];?>" /> +<input type="hidden" name="order" value="<?=htmlspecialchars($_GET['order']);?>" /> <?php if (!empty($cpzone)): ?> <?php if ($_GET['showact']): ?> <input type="hidden" name="showact" value="0" /> @@ -197,7 +197,7 @@ $mac_man = load_mac_manufacturer_table(); <input type="hidden" name="showact" value="1" /> <input type="submit" class="formbtn" value="<?=gettext("Show last activity");?>" /> <?php endif; ?> -<input type="hidden" name="zone" value="<?=$cpzone;?>" /> +<input type="hidden" name="zone" value="<?=htmlspecialchars($cpzone);?>" /> <?php endif; ?> </form> <?php include("fend.inc"); ?> |
