diff options
Diffstat (limited to 'usr/local/www/system_groupmanager_addprivs.php')
| -rw-r--r-- | usr/local/www/system_groupmanager_addprivs.php | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/usr/local/www/system_groupmanager_addprivs.php b/usr/local/www/system_groupmanager_addprivs.php index 29f0193..1c20a07 100644 --- a/usr/local/www/system_groupmanager_addprivs.php +++ b/usr/local/www/system_groupmanager_addprivs.php @@ -55,8 +55,9 @@ require("guiconfig.inc"); $pgtitle = array(gettext("System"),gettext("Group manager"),gettext("Add privileges")); -$groupid = $_GET['groupid']; -if (isset($_POST['groupid'])) +if (is_numericint($_GET['groupid'])) + $groupid = $_GET['groupid']; +if (isset($_POST['groupid']) && is_numericint($_POST['groupid'])) $groupid = $_POST['groupid']; $a_group = & $config['system']['group'][$groupid]; @@ -224,7 +225,7 @@ function update_description() { <input id="submitt" name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" /> <input id="cancelbutton" class="formbtn" type="button" value="<?=gettext("Cancel");?>" onclick="history.back()" /> <?php if (isset($groupid)): ?> - <input name="groupid" type="hidden" value="<?=$groupid;?>" /> + <input name="groupid" type="hidden" value="<?=htmlspecialchars($groupid);?>" /> <?php endif; ?> </td> </tr> |
