mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Encode shaper queue name before printing. Issue #9294

Browse Source 
Validation is already present and prevents bad values from being
entered.

(cherry picked from commit 1072b9333c)
This commit is contained in:
jim-p 2019-01-29 12:40:38 -05:00
parent 7e9de4b150
commit 9712ce4ef2
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/etc/inc/shaper.inc
View File

@ -1600,13 +1600,13 @@ class priq_queue {
}
function build_tree() {
$tree = " <li><a href=\"firewall_shaper.php?interface=". $this->GetInterface()."&amp;queue=". $this->GetQname()."&amp;action=show";
$tree = " <li><a href=\"firewall_shaper.php?interface=". $this->GetInterface()."&amp;queue=". htmlspecialchars($this->GetQname())."&amp;action=show";
$tree .= "\" ";
$tmpvalue = $this->GetDefault();
if (!empty($tmpvalue)) {
$tree .= " class=\"navlnk\"";
}
$tree .= " >" . $this->GetQname() . "</a>";
$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
/*
* Not needed here!
* if (is_array($queues) {
@ -2369,13 +2369,13 @@ class hfsc_queue extends priq_queue {
}
function build_tree() {
$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface() ."&amp;queue=" . $this->GetQname()."&amp;action=show";
$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface() ."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
$tree .= "\" ";
$tmpvalue = $this->GetDefault();
if (!empty($tmpvalue)) {
$tree .= " class=\"navlnk\"";
}
$tree .= " >" . $this->GetQname() . "</a>";
$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
if (is_array($this->subqueues)) {
$tree .= "<ul>";
foreach ($this->subqueues as $q) {
@ -2971,13 +2971,13 @@ class cbq_queue extends priq_queue {
}
function build_tree() {
$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface()."&amp;queue=" . $this->GetQname()."&amp;action=show";
$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface()."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
$tree .= "\" ";
$tmpvalue = trim($this->GetDefault());
if (!empty($tmpvalue)) {
$tree .= " class=\"navlnk\"";
}
$tree .= " >" . $this->GetQname() . "</a>";
$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
if (is_array($this->subqueues)) {
$tree .= "<ul>";
foreach ($this->subqueues as $q) {
@ -3259,13 +3259,13 @@ class fairq_queue extends priq_queue {
function build_tree() {
$tree = " <li><a href=\"firewall_shaper.php?interface=" .
$this->GetInterface()."&amp;queue=" . $this->GetQname()."&amp;action=show";
$this->GetInterface()."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
$tree .= "\" ";
$tmpvalue = trim($this->GetDefault());
if (!empty($tmpvalue)) {
$tree .= " class=\"navlnk\"";
}
$tree .= " >" . $this->GetQname() . "</a>";
$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
$tree .= "</li>";
return $tree;
}
@ -3979,8 +3979,8 @@ class dnpipe_class extends dummynet_class {
}
function build_tree() {
$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . $this->GetQname() ."&amp;queue=".$this->GetQname() ."&amp;action=show\">";
$tree .= $this->GetQname() . "</a>";
$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . htmlspecialchars($this->GetQname()) ."&amp;queue=".htmlspecialchars($this->GetQname()) ."&amp;action=show\">";
$tree .= htmlspecialchars($this->GetQname()) . "</a>";
if (is_array($this->subqueues)) {
$tree .= "<ul>";
foreach ($this->subqueues as $q) {
@ -4650,8 +4650,8 @@ class dnqueue_class extends dummynet_class {
function build_tree() {
$parent =& $this->GetParent();
$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . $parent->GetQname() ."&amp;queue=" . $this->GetQname() ."&amp;action=show\">";
$tree .= $this->GetQname() . "</a>";
$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . htmlspecialchars($parent->GetQname()) ."&amp;queue=" . htmlspecialchars($this->GetQname()) ."&amp;action=show\">";
$tree .= htmlspecialchars($this->GetQname()) . "</a>";
$tree .= "</li>";
return $tree;