mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Define a local boolean var for showact to avoid security issues, also pass order parameter trough htmlspecialchars()

Browse Source
This commit is contained in:
Renato Botelho 2014-11-18 11:49:13 -02:00
parent e91a43d6fe
commit 4b40d03612
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
usr/local/www/widgets/widgets/captive_portal_status.widget.php
View File

@ -72,11 +72,13 @@ function clientcmp($a, $b) {
$cpdb_all = array();
$showact = isset($_GET['showact']) ? 1 : 0;
foreach ($a_cp as $cpzone => $cp) {
$cpdb = captiveportal_read_db();
foreach ($cpdb as $cpent) {
$cpent[10] = $cpzone;
if ($_GET['showact'])
if ($showact == 1)
$cpent[11] = captiveportal_get_last_activity($cpent[2], $cpentry[3]);
$cpdb_all[] = $cpent;
}
@ -100,14 +102,14 @@ if ($_GET['order']) {
?>
<table class="sortable" id="sortabletable" width="100%" border="0" cellpadding="0" cellspacing="0" summary="captive portal status">
<tr>
<td class="listhdrr"><a href="?order=ip&amp;showact=<?=$_GET['showact'];?>">IP address</a></td>
<td class="listhdrr"><a href="?order=mac&amp;showact=<?=$_GET['showact'];?>">MAC address</a></td>
<td class="listhdrr"><a href="?order=user&amp;showact=<?=$_GET['showact'];?>"><?=gettext("Username");?></a></td>
<td class="listhdrr"><a href="?order=ip&amp;showact=<?=$showact;?>">IP address</a></td>
<td class="listhdrr"><a href="?order=mac&amp;showact=<?=$showact;?>">MAC address</a></td>
<td class="listhdrr"><a href="?order=user&amp;showact=<?=$showact;?>"><?=gettext("Username");?></a></td>
<?php
if ($_GET['showact']):
if ($showact == 1):
?>
<td class="listhdrr"><a href="?order=start&amp;showact=<?=$_GET['showact'];?>"><?=gettext("Session start");?></a></td>
<td class="listhdrr"><a href="?order=start&amp;showact=<?=$_GET['showact'];?>"><?=gettext("Last activity");?></a></td>
<td class="listhdrr"><a href="?order=start&amp;showact=<?=$showact;?>"><?=gettext("Session start");?></a></td>
<td class="listhdrr"><a href="?order=start&amp;showact=<?=$showact;?>"><?=gettext("Last activity");?></a></td>
<?php
endif;
?>
@ -120,7 +122,7 @@ foreach ($cpdb_all as $cpent):
<td class="listr"><?=$cpent[3];?>&nbsp;</td>
<td class="listr"><?=$cpent[4];?>&nbsp;</td>
<?php
if ($_GET['showact']):
if ($showact == 1):
?>
<td class="listr"><?=htmlspecialchars(date("m/d/Y H:i:s", $cpent[0]));?></td>
<td class="listr"><?php if ($cpent[11] && ($cpent[11] > 0)) echo htmlspecialchars(date("m/d/Y H:i:s", $cpent[11]));?></td>
@ -128,7 +130,7 @@ foreach ($cpdb_all as $cpent):
endif;
?>
<td valign="middle" class="list nowrap">
<a href="?order=<?=$_GET['order'];?>&amp;showact=<?=$_GET['showact'];?>&amp;act=del&amp;zone=<?=$cpent[10];?>&amp;id=<?=$cpent[5];?>" onclick="return confirm('Do you really want to disconnect this client?')">
<a href="?order=<?=htmlspecialchars($_GET['order']);?>&amp;showact=<?=$showact;?>&amp;act=del&amp;zone=<?=$cpent[10];?>&amp;id=<?=$cpent[5];?>" onclick="return confirm('Do you really want to disconnect this client?')">
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0" alt="x" />
</a>
</td>