From dd5bf424c155922b065b45e64733bdf8de620c0f Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Fri, 12 Nov 2010 11:36:13 -0500
Subject: Fix XSS issues

---
 usr/local/www/status_captiveportal_vouchers.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'usr/local/www/status_captiveportal_vouchers.php')

diff --git a/usr/local/www/status_captiveportal_vouchers.php b/usr/local/www/status_captiveportal_vouchers.php
index 39a6f56..4d3afd8 100644
--- a/usr/local/www/status_captiveportal_vouchers.php
+++ b/usr/local/www/status_captiveportal_vouchers.php
@@ -99,11 +99,11 @@ include("fbegin.inc");
 
 <table width="100%" border="0" cellpadding="0" cellspacing="0" summary="content pane">
   <tr>
-    <td class="listhdrr"><a href="?order=0&showact=<?=$_GET['showact'];?>"><?=gettext("Voucher"); ?></a></td>
-    <td class="listhdrr"><a href="?order=1&showact=<?=$_GET['showact'];?>"><?=gettext("Roll"); ?></a></td>
-    <td class="listhdrr"><a href="?order=2&showact=<?=$_GET['showact'];?>"><?=gettext("Activated at"); ?></a></td>
-    <td class="listhdrr"><a href="?order=3&showact=<?=$_GET['showact'];?>"><?=gettext("Expires in"); ?></a></td>
-    <td class="listhdr"><a href="?order=4&showact=<?=$_GET['showact'];?>"><?=gettext("Expires at"); ?></a></td>
+    <td class="listhdrr"><a href="?order=0&showact=<?=htmlspecialchars($_GET['showact']);?>"><?=gettext("Voucher"); ?></a></td>
+    <td class="listhdrr"><a href="?order=1&showact=<?=htmlspecialchars($_GET['showact']);?>"><?=gettext("Roll"); ?></a></td>
+    <td class="listhdrr"><a href="?order=2&showact=<?=htmlspecialchars($_GET['showact']);?>"><?=gettext("Activated at"); ?></a></td>
+    <td class="listhdrr"><a href="?order=3&showact=<?=htmlspecialchars($_GET['showact']);?>"><?=gettext("Expires in"); ?></a></td>
+    <td class="listhdr"><a href="?order=4&showact=<?=htmlspecialchars($_GET['showact']);?>"><?=gettext("Expires at"); ?></a></td>
     <td class="list"></td>
   </tr>
 <?php foreach ($db as $dbent): ?>
-- 
cgit v1.1