From 9712ce4ef2b5228aed2af3c84d9d8a5df480fbc1 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Tue, 29 Jan 2019 12:40:38 -0500
Subject: [PATCH] Encode shaper queue name before printing. Issue #9294

Validation is already present and prevents bad values from being
entered.

(cherry picked from commit 1072b9333c47df593420937361349b09a9b73639)
---
 src/etc/inc/shaper.inc | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/etc/inc/shaper.inc b/src/etc/inc/shaper.inc
index d59989d925..c017caf257 100644
--- a/src/etc/inc/shaper.inc
+++ b/src/etc/inc/shaper.inc
@@ -1600,13 +1600,13 @@ class priq_queue {
 	}
 
 	function build_tree() {
-		$tree = " <li><a href=\"firewall_shaper.php?interface=". $this->GetInterface()."&amp;queue=". $this->GetQname()."&amp;action=show";
+		$tree = " <li><a href=\"firewall_shaper.php?interface=". $this->GetInterface()."&amp;queue=". htmlspecialchars($this->GetQname())."&amp;action=show";
 		$tree .= "\" ";
 		$tmpvalue = $this->GetDefault();
 		if (!empty($tmpvalue)) {
 			$tree .= " class=\"navlnk\"";
 		}
-		$tree .= " >" . $this->GetQname() . "</a>";
+		$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
 		/*
 		 * Not needed here!
 		 * if (is_array($queues) {
@@ -2369,13 +2369,13 @@ class hfsc_queue extends priq_queue {
 	}
 
 	function build_tree() {
-		$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface() ."&amp;queue=" . $this->GetQname()."&amp;action=show";
+		$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface() ."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
 		$tree .= "\" ";
 		$tmpvalue = $this->GetDefault();
 		if (!empty($tmpvalue)) {
 			$tree .= " class=\"navlnk\"";
 		}
-		$tree .= " >" . $this->GetQname() . "</a>";
+		$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
 		if (is_array($this->subqueues)) {
 			$tree .= "<ul>";
 			foreach ($this->subqueues as $q) {
@@ -2971,13 +2971,13 @@ class cbq_queue extends priq_queue {
 	}
 
 	function build_tree() {
-		$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface()."&amp;queue=" . $this->GetQname()."&amp;action=show";
+		$tree = " <li><a href=\"firewall_shaper.php?interface=" . $this->GetInterface()."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
 		$tree .= "\" ";
 		$tmpvalue = trim($this->GetDefault());
 		if (!empty($tmpvalue)) {
 			$tree .= " class=\"navlnk\"";
 		}
-		$tree .= " >" . $this->GetQname() . "</a>";
+		$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
 		if (is_array($this->subqueues)) {
 			$tree .= "<ul>";
 			foreach ($this->subqueues as $q) {
@@ -3259,13 +3259,13 @@ class fairq_queue extends priq_queue {
 
 	function build_tree() {
 		$tree = " <li><a href=\"firewall_shaper.php?interface=" .
-		$this->GetInterface()."&amp;queue=" . $this->GetQname()."&amp;action=show";
+		$this->GetInterface()."&amp;queue=" . htmlspecialchars($this->GetQname())."&amp;action=show";
 		$tree .= "\" ";
 		$tmpvalue = trim($this->GetDefault());
 		if (!empty($tmpvalue)) {
 			$tree .= " class=\"navlnk\"";
 		}
-		$tree .= " >" . $this->GetQname() . "</a>";
+		$tree .= " >" . htmlspecialchars($this->GetQname()) . "</a>";
 		$tree .= "</li>";
 		return $tree;
 	}
@@ -3979,8 +3979,8 @@ class dnpipe_class extends dummynet_class {
 	}
 
 	function build_tree() {
-		$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . $this->GetQname() ."&amp;queue=".$this->GetQname() ."&amp;action=show\">";
-		$tree .= $this->GetQname() . "</a>";
+		$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . htmlspecialchars($this->GetQname()) ."&amp;queue=".htmlspecialchars($this->GetQname()) ."&amp;action=show\">";
+		$tree .= htmlspecialchars($this->GetQname()) . "</a>";
 		if (is_array($this->subqueues)) {
 			$tree .= "<ul>";
 			foreach ($this->subqueues as $q) {
@@ -4650,8 +4650,8 @@ class dnqueue_class extends dummynet_class {
 
 	function build_tree() {
 		$parent =& $this->GetParent();
-		$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . $parent->GetQname() ."&amp;queue=" . $this->GetQname() ."&amp;action=show\">";
-		$tree .= $this->GetQname() . "</a>";
+		$tree = " <li><a href=\"firewall_shaper_vinterface.php?pipe=" . htmlspecialchars($parent->GetQname()) ."&amp;queue=" . htmlspecialchars($this->GetQname()) ."&amp;action=show\">";
+		$tree .= htmlspecialchars($this->GetQname()) . "</a>";
 		$tree .= "</li>";
 
 		return $tree;