From 621baeb604d1125e10222a70ba9a7efa85eff22b Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Tue, 16 Jun 2015 10:13:09 -0400
Subject: Be more careful with encoding on pages that use single quotes around
 HTML attributes

---
 usr/local/www/services_captiveportal.php | 2 +-
 usr/local/www/system_hasync.php          | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'usr/local')

diff --git a/usr/local/www/services_captiveportal.php b/usr/local/www/services_captiveportal.php
index a56a6fc..6145949 100644
--- a/usr/local/www/services_captiveportal.php
+++ b/usr/local/www/services_captiveportal.php
@@ -1090,7 +1090,7 @@ function enable_change(enable_change) {
 	<tr>
 	  <td width="22%" valign="top">&nbsp;</td>
 	  <td width="78%">
-		<?php echo "<input name='zone' id='zone' type='hidden' value='" . htmlspecialchars($cpzone) . "' />"; ?>
+		<?php echo "<input name='zone' id='zone' type='hidden' value='" . htmlspecialchars($cpzone, ENT_QUOTES | ENT_HTML401) . "' />"; ?>
 		<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" onclick="enable_change(true)" />
 		<a href="services_captiveportal_zones.php"><input name="Cancel" type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="enable_change(true)" /></a>
 	  </td>
diff --git a/usr/local/www/system_hasync.php b/usr/local/www/system_hasync.php
index 7816665..329b745 100755
--- a/usr/local/www/system_hasync.php
+++ b/usr/local/www/system_hasync.php
@@ -142,7 +142,7 @@ include("head.inc");
 	<tr valign="top">
 		<td width="22%" class="vncell">pfsync Synchronize Peer IP</td>
 		<td class="vtable">
-			<input  id='pfsyncpeerip' name='pfsyncpeerip' class='formfld unknown' value='<?= htmlentities($pconfig['pfsyncpeerip']); ?>' />
+			<input  id='pfsyncpeerip' name='pfsyncpeerip' class='formfld unknown' value='<?= htmlentities($pconfig['pfsyncpeerip'], ENT_QUOTES | ENT_HTML401); ?>' />
 			<br />
 			Setting this option will force pfsync to synchronize its state table to this IP address.  The default is directed multicast.
 		</td>
@@ -156,7 +156,7 @@ include("head.inc");
 	<tr valign="top">
 		<td width="22%" class="vncell">Synchronize Config to IP</td>
 		<td class="vtable">
-			<input  id='synchronizetoip' name='synchronizetoip' class='formfld unknown' value='<?= htmlentities($pconfig['synchronizetoip']); ?>' />
+			<input  id='synchronizetoip' name='synchronizetoip' class='formfld unknown' value='<?= htmlentities($pconfig['synchronizetoip'], ENT_QUOTES | ENT_HTML401); ?>' />
 			<br />
 			Enter the IP address of the firewall to which the selected configuration sections should be synchronized.<br />
 			<br />
@@ -168,7 +168,7 @@ include("head.inc");
 	<tr valign="top">
 		<td width="22%" class="vncell">Remote System Username</td>
 		<td class="vtable">
-			<input  id='username' name='username' class='formfld unknown' value='<?= htmlentities($pconfig['username']); ?>' />
+			<input  id='username' name='username' class='formfld unknown' value='<?= htmlentities($pconfig['username'], ENT_QUOTES | ENT_HTML401); ?>' />
 			<br />
 			Enter the webConfigurator username of the system entered above for synchronizing your configuration.<br />
 			<br />
@@ -178,7 +178,7 @@ include("head.inc");
 	<tr valign="top">
 		<td width="22%" class="vncell">Remote System Password</td>
 		<td class="vtable">
-			<input  id='passwordfld' type='password'  name='passwordfld' class='formfld pwd' value='<?= htmlentities($pconfig['passwordfld']); ?>' />
+			<input  id='passwordfld' type='password'  name='passwordfld' class='formfld pwd' value='<?= htmlentities($pconfig['passwordfld'], ENT_QUOTES | ENT_HTML401); ?>' />
 			<br />
 			Enter the webConfigurator password of the system entered above for synchronizing your configuration.<br />
 			<br />
-- 
cgit v1.1