From 2c06742d784cb7ec85151327fd753536d98fbcc1 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 7 Feb 2017 11:14:25 -0500
Subject: Encode 'from' and 'to' before output on pkg_mgr_install.php. Fixes
 #7225

---
 src/usr/local/www/pkg_mgr_install.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/usr/local/www/pkg_mgr_install.php')

diff --git a/src/usr/local/www/pkg_mgr_install.php b/src/usr/local/www/pkg_mgr_install.php
index 9e11d80..5d1f10f 100644
--- a/src/usr/local/www/pkg_mgr_install.php
+++ b/src/usr/local/www/pkg_mgr_install.php
@@ -294,7 +294,7 @@ if (!$confirmed && !$completed &&
 <?php
 			elseif ($_GET['from'] && $_GET['to']):
 ?>
-				<?=sprintf(gettext('Confirmation Required to upgrade package %1$s from %2$s to %3$s.'), $pkgname, $_GET['from'], $_GET['to'])?>
+				<?=sprintf(gettext('Confirmation Required to upgrade package %1$s from %2$s to %3$s.'), $pkgname, htmlspecialchars($_GET['from']), htmlspecialchars($_GET['to']))?>
 <?php
 			elseif ($firmwareupdate):
 ?>
-- 
cgit v1.1