mirror of
https://github.com/pfsense/pfsense.git
synced 2025-10-26 11:38:35 +00:00
Allow the use of ">" in filter rule descriptions. Even whilst stripping the > before the comparison htmlentities
will still trigger on the <. It is safe to assume here that creating any sort of html tag is unlikely. Ticket #465
This commit is contained in:
parent
ee23ccabcd
commit
08825acc2c
@ -247,7 +247,8 @@ if ($_POST) {
|
||||
* cannot think he is slick and perform a XSS attack on the unwilling
|
||||
*/
|
||||
foreach ($_POST as $key => $value) {
|
||||
$temp = $value;
|
||||
$temp = str_replace(">", "", $value);
|
||||
|
||||
if (isset($_POST['floating']) && $key == "interface")
|
||||
continue;
|
||||
$newpost = htmlentities($temp);
|
||||
|
||||
Loading…
Reference in New Issue
Block a user