From d83a4dfcdb0f61f4d7311c42e917f27691834a84 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Mon, 21 Dec 2015 09:04:11 -0500
Subject: Encode DNS servers and their associated gateways before printing

---
 usr/local/www/system.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'usr')

diff --git a/usr/local/www/system.php b/usr/local/www/system.php
index e313aba..e78023c 100644
--- a/usr/local/www/system.php
+++ b/usr/local/www/system.php
@@ -347,7 +347,7 @@ include("head.inc");
 							?>
 							<tr>
 								<td>
-									<input name="dns<?php echo $dnscounter;?>" type="text" class="formfld unknown" id="dns<?php echo $dnscounter;?>" size="28" value="<?php echo $pconfig['dns'.$dnscounter];?>" />
+									<input name="dns<?php echo $dnscounter;?>" type="text" class="formfld unknown" id="dns<?php echo $dnscounter;?>" size="28" value="<?php echo htmlspecialchars($pconfig['dns'.$dnscounter]);?>" />
 								</td>
 								<td>
 <?php if ($multiwan): ?>
@@ -374,7 +374,7 @@ include("head.inc");
 												} else {
 													$selected = "";
 												}
-												echo "<option value='$gwname' $selected>$gwname - {$gwitem['friendlyiface']} - {$gwitem['gateway']}</option>\n";
+												echo "<option value='" . htmlspecialchars($gwname) . "' $selected>" . htmlspecialchars("{$gwname} - {$gwitem['friendlyiface']} - {$gwitem['gateway']}") . " </option>\n";
 											}
 										?>
 									</select>
-- 
cgit v1.1