From 5bf478ac2efecc20aa87483fe699faecee39225f Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Thu, 27 Aug 2015 09:29:40 -0400
Subject: [PATCH] Ensure the current RRD graph category is encoded before
 display

---
 usr/local/www/status_rrd_graph.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/local/www/status_rrd_graph.php b/usr/local/www/status_rrd_graph.php
index e64cf72505..a4aec6d835 100644
--- a/usr/local/www/status_rrd_graph.php
+++ b/usr/local/www/status_rrd_graph.php
@@ -409,7 +409,7 @@ function get_dates($curperiod, $graph) {
 <table width="100%" border="0" cellpadding="0" cellspacing="0" summary="rrd graphs">
         <tr>
                 <td>
-			<input type="hidden" name="cat" value="<?php echo "$curcat"; ?>" />
+			<input type="hidden" name="cat" value="<?php echo htmlspecialchars($curcat); ?>" />
 			<?php
 			        $tab_array = array();
 				if($curcat == "system") { $tabactive = True; } else { $tabactive = False; }