From dd5bf424c155922b065b45e64733bdf8de620c0f Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Fri, 12 Nov 2010 11:36:13 -0500
Subject: Fix XSS issues

---
 usr/local/www/system_usermanager.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'usr/local/www/system_usermanager.php')

diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php
index d4adf9e..9256c40 100644
--- a/usr/local/www/system_usermanager.php
+++ b/usr/local/www/system_usermanager.php
@@ -466,7 +466,7 @@ function sshkeyClicked(obj) {
 	                        <td width="22%" valign="top" class="vncell"><?=gettext("Defined by");?></td>
 	                        <td width="78%" class="vtable">
 	                            <strong><?=strtoupper($pconfig['utype']);?></strong>
-								<input name="utype" type="hidden" value="<?=$pconfig['utype']?>"/>
+								<input name="utype" type="hidden" value="<?=htmlspecialchars($pconfig['utype'])?>"/>
 	                        </td>
 	                    </tr>
 						<tr>
@@ -504,7 +504,7 @@ function sshkeyClicked(obj) {
 						<tr>
 							<td width="22%" valign="top" class="vncell"><?=gettext("Expiration date"); ?></td>
 							<td width="78%" class="vtable">
-								<input name="expires" type="text" class="formfld unknown" id="expires" size="10" value="<?=$pconfig['expires'];?>">
+								<input name="expires" type="text" class="formfld unknown" id="expires" size="10" value="<?=htmlspecialchars($pconfig['expires']);?>">
 								<a href="javascript:NewCal('expires','mmddyyyy')">
 									<img src="/themes/<?php echo $g['theme']; ?>/images/icons/icon_cal.gif" width="16" height="16" border="0" alt="<?=gettext("Pick a date");?>">
 								</a>
-- 
cgit v1.1