From 08825acc2c6fff6bb5ea090a3a9544cd495ea32c Mon Sep 17 00:00:00 2001 From: smos Date: Fri, 14 May 2010 14:00:45 +0200 Subject: [PATCH] Allow the use of ">" in filter rule descriptions. Even whilst stripping the > before the comparison htmlentities will still trigger on the <. It is safe to assume here that creating any sort of html tag is unlikely. Ticket #465 --- usr/local/www/firewall_rules_edit.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php index 05ad793e39..2baaef003e 100755 --- a/usr/local/www/firewall_rules_edit.php +++ b/usr/local/www/firewall_rules_edit.php @@ -247,7 +247,8 @@ if ($_POST) { * cannot think he is slick and perform a XSS attack on the unwilling */ foreach ($_POST as $key => $value) { - $temp = $value; + $temp = str_replace(">", "", $value); + if (isset($_POST['floating']) && $key == "interface") continue; $newpost = htmlentities($temp);