Allow the use of ">" in filter rule descriptions. Even whilst stripping the > before the comparison htmlentities

will still trigger on the <. It is safe to assume here that creating any sort of html tag is unlikely. Ticket #465
This commit is contained in:
smos 2010-05-14 14:00:45 +02:00
parent ee23ccabcd
commit 08825acc2c

View File

@ -247,7 +247,8 @@ if ($_POST) {
* cannot think he is slick and perform a XSS attack on the unwilling
*/
foreach ($_POST as $key => $value) {
$temp = $value;
$temp = str_replace(">", "", $value);
if (isset($_POST['floating']) && $key == "interface")
continue;
$newpost = htmlentities($temp);