From 609ef33537e10e6faef38bbbeb16e477384a4503 Mon Sep 17 00:00:00 2001 From: Steve Beaver Date: Mon, 18 Dec 2017 08:31:02 -0500 Subject: [PATCH] Fixes #8219 Escape single quotes when they arise from ICMP description translations --- src/usr/local/www/firewall_rules_edit.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/usr/local/www/firewall_rules_edit.php b/src/usr/local/www/firewall_rules_edit.php index 7029c293aa..10aa64710a 100644 --- a/src/usr/local/www/firewall_rules_edit.php +++ b/src/usr/local/www/firewall_rules_edit.php @@ -40,15 +40,16 @@ $icmptypes4 = array('any' => gettext('any')); $icmptypes6 = array('any' => gettext('any')); $icmptypes46 = array('any' => gettext('any')); +// ICMP descriptions may be translated, so require escaping to handle single quotes (in particular) foreach ($icmptypes as $k => $v) { if ($v['valid4']) { - $icmptypes4[$k] = $v['descrip']; + $icmptypes4[$k] = addslashes($v['descrip']); if ($v['valid6']) { - $icmptypes6[$k] = $v['descrip']; - $icmptypes46[$k] = $v['descrip']; + $icmptypes6[$k] = addslashes($v['descrip']); + $icmptypes46[$k] = addslashes($v['descrip']); } } else { - $icmptypes6[$k] = $v['descrip']; + $icmptypes6[$k] = addslashes($v['descrip']); } }