From f7ca96741d67a0719da213d410cf17e4437619f4 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Wed, 1 Jul 2015 11:16:25 -0400
Subject: Encode ca/cert descr in vpn_openvpn_client.php

---
 usr/local/www/vpn_openvpn_client.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'usr/local/www')

diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php
index 7ec74ce..1c2652a 100644
--- a/usr/local/www/vpn_openvpn_client.php
+++ b/usr/local/www/vpn_openvpn_client.php
@@ -758,7 +758,7 @@ if ($savemsg)
 									if ($pconfig['caref'] == $ca['refid'])
 										$selected = "selected=\"selected\"";
 							?>
-								<option value="<?=$ca['refid'];?>" <?=$selected;?>><?=$ca['descr'];?></option>
+								<option value="<?=$ca['refid'];?>" <?=$selected;?>><?=htmlspecialchars($ca['descr']);?></option>
 							<?php endforeach; ?>
 							</select>
 							<?php else: ?>
@@ -778,7 +778,7 @@ if ($savemsg)
 								$revoked = "";
 								$ca = lookup_ca($cert['caref']);
 								if ($ca)
-									$caname = " (CA: {$ca['descr']})";
+									$caname = " (CA: " . htmlspecialchars($ca['descr']) . ")";
 								if ($pconfig['certref'] == $cert['refid'])
 									$selected = "selected=\"selected\"";
 								if (cert_in_use($cert['refid']))
@@ -786,7 +786,7 @@ if ($savemsg)
 								if (is_cert_revoked($cert))
 									$revoked = " *Revoked";
 							?>
-								<option value="<?=$cert['refid'];?>" <?=$selected;?>><?=$cert['descr'] . $caname . $inuse . $revoked;?></option>
+								<option value="<?=$cert['refid'];?>" <?=$selected;?>><?=htmlspecialchars($cert['descr']) . $caname . $inuse . $revoked;?></option>
 							<?php endforeach; ?>
 								<option value="" <?PHP if (empty($pconfig['certref'])) echo "selected=\"selected\""; ?>>None (Username and/or Password required)</option>
 							</select>
-- 
cgit v1.1