From e41ec5848f21015068255c1d61d01edf442e8e7e Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 12 Mar 2014 11:35:57 -0300 Subject: Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print --- usr/local/www/services_dhcpv6_edit.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'usr/local/www/services_dhcpv6_edit.php') diff --git a/usr/local/www/services_dhcpv6_edit.php b/usr/local/www/services_dhcpv6_edit.php index 32ac04a..40f71ca 100644 --- a/usr/local/www/services_dhcpv6_edit.php +++ b/usr/local/www/services_dhcpv6_edit.php @@ -82,8 +82,9 @@ $ifcfgipv6 = get_interface_ipv6($if); $ifcfgsnv6 = get_interface_subnetv6($if); $ifcfgdescr = convert_friendly_interface_to_friendly_descr($if); -$id = $_GET['id']; -if (isset($_POST['id'])) +if (is_numericint($_GET['id'])) + $id = $_GET['id']; +if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; if (isset($id) && $a_maps[$id]) { -- cgit v1.1