From 8ebf884f82c80f8623bfba2a37aef3cf7079ed79 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Mon, 21 Dec 2015 09:17:42 -0500
Subject: Encode gateway attributes before printing

---
 src/usr/local/www/status_gateways.php | 6 +++---
 src/usr/local/www/system_gateways.php | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'src/usr')

diff --git a/src/usr/local/www/status_gateways.php b/src/usr/local/www/status_gateways.php
index 2c7ecf4..97c0051 100644
--- a/src/usr/local/www/status_gateways.php
+++ b/src/usr/local/www/status_gateways.php
@@ -106,7 +106,7 @@ display_top_tabs($tab_array);
 ?>
 			<tr>
 				<td>
-					<?=$gateway['name'];?>
+					<?=htmlspecialchars($gateway['name']);?>
 				</td>
 				<td>
 					<?php echo lookup_gateway_ip_by_name($gname);?>
@@ -116,7 +116,7 @@ display_top_tabs($tab_array);
 					if ($gateways_status[$gname]) {
 						echo $gateways_status[$gname]['monitorip'];
 					} else {
-						echo $gateway['monitorip'];
+						echo htmlspecialchars($gateway['monitorip']);
 					}
 ?>
 				</td>
@@ -180,7 +180,7 @@ display_top_tabs($tab_array);
 				</td>
 
 				<td>
-					<?=$gateway['descr']; ?>
+					<?=htmlspecialchars($gateway['descr']); ?>
 				</td>
 			</tr>
 <?php	} ?>	<!-- End-of-foreach -->
diff --git a/src/usr/local/www/system_gateways.php b/src/usr/local/www/system_gateways.php
index e297053..271f8f3 100644
--- a/src/usr/local/www/system_gateways.php
+++ b/src/usr/local/www/system_gateways.php
@@ -296,7 +296,7 @@ foreach ($a_gateways as $i => $gateway):
 	<tr<?=($icon != 'fa-check-circle-o')? ' class="disabled"' : ''?>>
 		<td title="<?=$title?>"><i class="fa <?=$icon?>"></i></td>
 		<td>
-			<?=$gateway['name']?>
+			<?=htmlspecialchars($gateway['name'])?>
 <?php
 			if (isset($gateway['defaultgw'])) {
 				echo " <strong>(default)</strong>";
@@ -307,7 +307,7 @@ foreach ($a_gateways as $i => $gateway):
 			<?=htmlspecialchars(convert_friendly_interface_to_friendly_descr($gateway['friendlyiface']))?>
 		</td>
 		<td>
-			<?=$gateway['gateway']?>
+			<?=htmlspecialchars($gateway['gateway'])?>
 		</td>
 		<td>
 			<?=htmlspecialchars($gateway['monitor'])?>
-- 
cgit v1.1