From ca0234c39abc2375bf9be5d2e236dea40a716182 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Tue, 29 Jan 2019 11:48:50 -0500
Subject: Validate NTP GPS type, encode output. Issue #9294

(cherry picked from commit 938988609c306fcd44e25a053745c4b8332eeeb5)
---
 src/usr/local/www/services_ntpd_gps.php | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/src/usr/local/www/services_ntpd_gps.php b/src/usr/local/www/services_ntpd_gps.php
index 056343a..ebe98cd 100644
--- a/src/usr/local/www/services_ntpd_gps.php
+++ b/src/usr/local/www/services_ntpd_gps.php
@@ -29,6 +29,8 @@
 
 require_once("guiconfig.inc");
 
+$gpstypes = array(gettext('Custom'), gettext('Default'), 'Generic', 'Garmin', 'MediaTek', 'SiRF', 'U-Blox', 'SureGPS');
+
 function set_default_gps() {
 	global $config;
 
@@ -147,7 +149,19 @@ function autocorrect_initcmd($initcmd) {
 }
 
 if ($_POST) {
-	unset($input_errors);
+	$input_errors = array();
+	if (!in_array($_POST['gpstype'], $gpstypes)) {
+		$input_errors[] = gettext("The submitted GPS type is invalid.");
+	}
+} else {
+	/* set defaults if they do not already exist */
+	if (!is_array($config['ntpd']) || !is_array($config['ntpd']['gps']) || empty($config['ntpd']['gps']['type'])) {
+		set_default_gps();
+	}
+}
+
+
+if ($_POST && empty($input_errors)) {
 
 	if (!empty($_POST['gpsport']) && file_exists('/dev/'.$_POST['gpsport'])) {
 		$config['ntpd']['gps']['port'] = $_POST['gpsport'];
@@ -275,11 +289,6 @@ if ($_POST) {
 	$changes_applied = true;
 	$retval = 0;
 	$retval |= system_ntp_configure();
-} else {
-	/* set defaults if they do not already exist */
-	if (!is_array($config['ntpd']) || !is_array($config['ntpd']['gps']) || empty($config['ntpd']['gps']['type'])) {
-		set_default_gps();
-	}
 }
 
 function build_nmea_list() {
@@ -313,6 +322,10 @@ $pglinks = array("", "services_ntpd.php", "@self");
 $shortcut_section = "ntp";
 include("head.inc");
 
+if ($input_errors) {
+	print_input_errors($input_errors);
+}
+
 if ($changes_applied) {
 	print_apply_result_box($retval);
 }
@@ -337,8 +350,6 @@ $section->addInput(new Form_StaticText(
 	' to minimize clock drift if the GPS data is not valid over time. Otherwise ntpd may only use values from the unsynchronized local clock when providing time to clients.'
 ));
 
-$gpstypes = array(gettext('Custom'), gettext('Default'), 'Generic', 'Garmin', 'MediaTek', 'SiRF', 'U-Blox', 'SureGPS');
-
 $section->addInput(new Form_Select(
 	'gpstype',
 	'GPS Type',
@@ -703,10 +714,10 @@ events.push(function() {
 		set_gps_default($(this).val());
 		hideInput('processpgrmf', ($(this).val() !== "Garmin" && $(this).val() !== "Custom"));
 	});
-	hideInput('processpgrmf', ('<?=$pconfig['type']?>' !== "Garmin" && '<?=$pconfig['type']?>' !== "Custom"));
+	hideInput('processpgrmf', (<?=json_encode($pconfig['type'])?> !== "Garmin" && <?=json_encode($pconfig['type'])?> !== "Custom"));
 
 	if ('<?=$pconfig['initcmd']?>' == '') {
-		set_gps_default('<?=$pconfig['type']?>');
+		set_gps_default(<?=json_encode($pconfig['type'])?>);
 	}
 
 	//	Checkboxes gpsprefer and gpsnoselect are mutually exclusive
-- 
cgit v1.1