summaryrefslogtreecommitdiffstats
path: root/usr/local
diff options
context:
space:
mode:
authorjim-p <jimp@pfsense.org>2015-06-16 10:13:09 -0400
committerjim-p <jimp@pfsense.org>2015-06-16 10:13:09 -0400
commit621baeb604d1125e10222a70ba9a7efa85eff22b (patch)
tree6663a62f23ef694d5abdf06dd2a7fa4eb0bff659 /usr/local
parent6dbe58e1018b524d9085ac1a84eb6564d2adc955 (diff)
downloadpfsense-621baeb604d1125e10222a70ba9a7efa85eff22b.zip
pfsense-621baeb604d1125e10222a70ba9a7efa85eff22b.tar.gz
Be more careful with encoding on pages that use single quotes around HTML attributes
Diffstat (limited to 'usr/local')
-rw-r--r--usr/local/www/services_captiveportal.php2
-rwxr-xr-xusr/local/www/system_hasync.php8
2 files changed, 5 insertions, 5 deletions
diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php
index a56a6fc..6145949 100644
--- a/usr/local/www/services_captiveportal.php
+++ b/usr/local/www/services_captiveportal.php
@@ -1090,7 +1090,7 @@ function enable_change(enable_change) {
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
- <?php echo "<input name='zone' id='zone' type='hidden' value='" . htmlspecialchars($cpzone) . "' />"; ?>
+ <?php echo "<input name='zone' id='zone' type='hidden' value='" . htmlspecialchars($cpzone, ENT_QUOTES | ENT_HTML401) . "' />"; ?>
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" onclick="enable_change(true)" />
<a href="services_captiveportal_zones.php"><input name="Cancel" type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="enable_change(true)" /></a>
</td>
diff --git a/usr/local/www/system_hasync.php b/usr/local/www/system_hasync.php
index 7816665..329b745 100755
--- a/usr/local/www/system_hasync.php
+++ b/usr/local/www/system_hasync.php
@@ -142,7 +142,7 @@ include("head.inc");
<tr valign="top">
<td width="22%" class="vncell">pfsync Synchronize Peer IP</td>
<td class="vtable">
- <input id='pfsyncpeerip' name='pfsyncpeerip' class='formfld unknown' value='<?= htmlentities($pconfig['pfsyncpeerip']); ?>' />
+ <input id='pfsyncpeerip' name='pfsyncpeerip' class='formfld unknown' value='<?= htmlentities($pconfig['pfsyncpeerip'], ENT_QUOTES | ENT_HTML401); ?>' />
<br />
Setting this option will force pfsync to synchronize its state table to this IP address. The default is directed multicast.
</td>
@@ -156,7 +156,7 @@ include("head.inc");
<tr valign="top">
<td width="22%" class="vncell">Synchronize Config to IP</td>
<td class="vtable">
- <input id='synchronizetoip' name='synchronizetoip' class='formfld unknown' value='<?= htmlentities($pconfig['synchronizetoip']); ?>' />
+ <input id='synchronizetoip' name='synchronizetoip' class='formfld unknown' value='<?= htmlentities($pconfig['synchronizetoip'], ENT_QUOTES | ENT_HTML401); ?>' />
<br />
Enter the IP address of the firewall to which the selected configuration sections should be synchronized.<br />
<br />
@@ -168,7 +168,7 @@ include("head.inc");
<tr valign="top">
<td width="22%" class="vncell">Remote System Username</td>
<td class="vtable">
- <input id='username' name='username' class='formfld unknown' value='<?= htmlentities($pconfig['username']); ?>' />
+ <input id='username' name='username' class='formfld unknown' value='<?= htmlentities($pconfig['username'], ENT_QUOTES | ENT_HTML401); ?>' />
<br />
Enter the webConfigurator username of the system entered above for synchronizing your configuration.<br />
<br />
@@ -178,7 +178,7 @@ include("head.inc");
<tr valign="top">
<td width="22%" class="vncell">Remote System Password</td>
<td class="vtable">
- <input id='passwordfld' type='password' name='passwordfld' class='formfld pwd' value='<?= htmlentities($pconfig['passwordfld']); ?>' />
+ <input id='passwordfld' type='password' name='passwordfld' class='formfld pwd' value='<?= htmlentities($pconfig['passwordfld'], ENT_QUOTES | ENT_HTML401); ?>' />
<br />
Enter the webConfigurator password of the system entered above for synchronizing your configuration.<br />
<br />
OpenPOWER on IntegriCloud