diff --git a/usr/local/www/system_groupmanager.php b/usr/local/www/system_groupmanager.php
index 94349ee833..0ca9f5d69b 100644
--- a/usr/local/www/system_groupmanager.php
+++ b/usr/local/www/system_groupmanager.php
@@ -53,36 +53,38 @@ if (!is_array($config['system']['group']))
$a_group = &$config['system']['group'];
-$id = $_GET['id'];
-if (isset($_POST['id']))
- $id = $_POST['id'];
+unset($id);
+if (isset($_POST['groupid']) && is_numericint($_POST['groupid']))
+ $id = $_POST['groupid'];
-if ($_GET['act'] == "delgroup") {
+$act = (isset($_POST['act']) ? $_POST['act'] : '');
- if (!$a_group[$_GET['id']]) {
+if ($act == "delgroup") {
+
+ if (!isset($id) || !isset($_POST['groupname']) || !isset($a_group[$id]) || ($_POST['groupname'] != $a_group[$id]['name'])) {
pfSenseHeader("system_groupmanager.php");
exit;
}
conf_mount_rw();
- local_group_del($a_group[$_GET['id']]);
+ local_group_del($a_group[$id]);
conf_mount_ro();
- $groupdeleted = $a_group[$_GET['id']]['name'];
- unset($a_group[$_GET['id']]);
+ $groupdeleted = $a_group[$id]['name'];
+ unset($a_group[$id]);
write_config();
$savemsg = gettext("Group")." {$groupdeleted} ".
- gettext("successfully deleted")."
";
+ gettext("successfully deleted")."
";
}
-if ($_GET['act'] == "delpriv") {
+if ($act == "delpriv") {
- if (!$a_group[$_GET['id']]) {
+ if (!isset($id) || !isset($a_group[$id])) {
pfSenseHeader("system_groupmanager.php");
exit;
}
- $privdeleted = $priv_list[$a_group[$id]['priv'][$_GET['privid']]]['name'];
- unset($a_group[$id]['priv'][$_GET['privid']]);
+ $privdeleted = $priv_list[$a_group[$id]['priv'][$_POST['privid']]]['name'];
+ unset($a_group[$id]['priv'][$_POST['privid']]);
if (is_array($a_group[$id]['member'])) {
foreach ($a_group[$id]['member'] as $uid) {
@@ -93,13 +95,13 @@ if ($_GET['act'] == "delpriv") {
}
write_config();
- $_GET['act'] = "edit";
+ $act = "edit";
$savemsg = gettext("Privilege")." {$privdeleted} ".
gettext("successfully deleted")."
";
}
-if($_GET['act']=="edit"){
- if (isset($id) && $a_group[$id]) {
+if ($act == "edit") {
+ if (isset($id) && isset($a_group[$id])) {
$pconfig['name'] = $a_group[$id]['name'];
$pconfig['gid'] = $a_group[$id]['gid'];
$pconfig['gtype'] = $a_group[$id]['scope'];
@@ -109,7 +111,7 @@ if($_GET['act']=="edit"){
}
}
-if ($_POST) {
+if (isset($_POST['save'])) {
unset($input_errors);
$pconfig = $_POST;
@@ -263,9 +265,12 @@ function presubmit() {