From 7100f0410b02d152f12f95fa892c427b06ec26c0 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 7 Feb 2017 11:45:20 -0500
Subject: Encode the contents of pkg_filter before output. Fixes #7227

---
 src/usr/local/www/pkg.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/usr')

diff --git a/src/usr/local/www/pkg.php b/src/usr/local/www/pkg.php
index 5e2a90e..5edc566 100644
--- a/src/usr/local/www/pkg.php
+++ b/src/usr/local/www/pkg.php
@@ -373,7 +373,7 @@ if ($savemsg) {
 					echo "</select>";
 				}
 				if ($include_filtering_inputbox) {
-					echo '&nbsp;&nbsp;' . gettext("Filter text: ") . '<input id="pkg_filter" name="pkg_filter" value="' . $_REQUEST['pkg_filter'] . '" />';
+					echo '&nbsp;&nbsp;' . gettext("Filter text: ") . '<input id="pkg_filter" name="pkg_filter" value="' . htmlspecialchars($_REQUEST['pkg_filter']) . '" />';
 					echo '&nbsp;<button type="submit" value="Filter" class="btn btn-primary btn-xs">';
 					echo '<i class="fa fa-filter icon-embed-btn"></i>';
 					echo gettext("Filter");
-- 
cgit v1.1