From 082f3663d2ac75e1f7e718715ea23b0168a866a7 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 7 Feb 2017 11:14:25 -0500
Subject: Encode 'from' and 'to' before output on pkg_mgr_install.php. Fixes
 #7225

---
 src/usr/local/www/pkg_mgr_install.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/usr/local/www/pkg_mgr_install.php b/src/usr/local/www/pkg_mgr_install.php
index f83bfc9..d123cc5 100644
--- a/src/usr/local/www/pkg_mgr_install.php
+++ b/src/usr/local/www/pkg_mgr_install.php
@@ -319,7 +319,7 @@ if (!$confirmed && !$completed &&
 <?php
 			elseif ($_GET['from'] && $_GET['to']):
 ?>
-				<?=sprintf(gettext('Confirmation Required to upgrade package %1$s from %2$s to %3$s.'), $pkgname, $_GET['from'], $_GET['to'])?>
+				<?=sprintf(gettext('Confirmation Required to upgrade package %1$s from %2$s to %3$s.'), $pkgname, htmlspecialchars($_GET['from']), htmlspecialchars($_GET['to']))?>
 <?php
 			elseif ($firmwareupdate):
 ?>
-- 
cgit v1.1