diff options
author | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:35:57 -0300 |
---|---|---|
committer | Renato Botelho <garga@FreeBSD.org> | 2014-03-12 11:42:49 -0300 |
commit | e41ec5848f21015068255c1d61d01edf442e8e7e (patch) | |
tree | 45c3214c1e3d638dbacb217cd3de95fb4aa6e770 /usr/local/www/system_gateways_edit.php | |
parent | 49f3f28fea92114b09d3b2d8103398c4adcb3635 (diff) | |
download | pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.zip pfsense-e41ec5848f21015068255c1d61d01edf442e8e7e.tar.gz |
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print
Diffstat (limited to 'usr/local/www/system_gateways_edit.php')
-rwxr-xr-x | usr/local/www/system_gateways_edit.php | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php index f28a34d..a3357ef 100755 --- a/usr/local/www/system_gateways_edit.php +++ b/usr/local/www/system_gateways_edit.php @@ -55,13 +55,13 @@ if (!is_array($config['gateways']['gateway_item'])) $a_gateway_item = &$config['gateways']['gateway_item']; $apinger_default = return_apinger_defaults(); -$id = $_GET['id']; -if (isset($_POST['id'])) +if (is_numericint($_GET['id'])) + $id = $_GET['id']; +if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; -if (isset($_GET['dup'])) { +if (isset($_GET['dup']) && is_numericint($_GET['dup'])) $id = $_GET['dup']; -} if (isset($id) && $a_gateways[$id]) { $pconfig = array(); @@ -94,7 +94,7 @@ if (isset($id) && $a_gateways[$id]) { $pconfig['disabled'] = isset($a_gateways[$id]['disabled']); } -if (isset($_GET['dup'])) { +if (isset($_GET['dup']) && is_numericint($_GET['dup'])) { unset($id); unset($pconfig['attribute']); } |