From 0e6cf71b17cc57c40aebc64359c1a27e2515b7b7 Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Wed, 12 Mar 2014 11:35:57 -0300 Subject: Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print --- usr/local/www/system_gateway_groups_edit.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'usr/local/www/system_gateway_groups_edit.php') diff --git a/usr/local/www/system_gateway_groups_edit.php b/usr/local/www/system_gateway_groups_edit.php index fadc283..ecab27a 100755 --- a/usr/local/www/system_gateway_groups_edit.php +++ b/usr/local/www/system_gateway_groups_edit.php @@ -55,13 +55,13 @@ $categories = array('down' => gettext("Member Down"), 'downlatency' => gettext("High Latency"), 'downlosslatency' => gettext("Packet Loss or High Latency")); -$id = $_GET['id']; -if (isset($_POST['id'])) +if (is_numericint($_GET['id'])) + $id = $_GET['id']; +if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; -if (isset($_GET['dup'])) { +if (isset($_GET['dup']) && is_numericint($_GET['dup'])) $id = $_GET['dup']; -} if (isset($id) && $a_gateway_groups[$id]) { $pconfig['name'] = $a_gateway_groups[$id]['name']; @@ -70,7 +70,7 @@ if (isset($id) && $a_gateway_groups[$id]) { $pconfig['trigger'] = $a_gateway_groups[$id]['trigger']; } -if (isset($_GET['dup'])) +if (isset($_GET['dup']) && is_numericint($_GET['dup'])) unset($id); if ($_POST) { -- cgit v1.1