From ce77c104eee92cfbbc0d84980e60899295dadeac Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 9 May 2019 15:17:35 -0400 Subject: [PATCH] Encode download parameter before use. Fixes #9508 --- src/usr/local/www/services_acb.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/usr/local/www/services_acb.php b/src/usr/local/www/services_acb.php index 51beff6056..ad7c64b7d9 100644 --- a/src/usr/local/www/services_acb.php +++ b/src/usr/local/www/services_acb.php @@ -371,7 +371,7 @@ if ($_REQUEST['download']) { $tab_array[1] = array("Restore", $active, "/services_acb.php"); if ($_REQUEST['download']) { - $tab_array[] = array("Revision", true, "/services_acb.php?download={$_REQUEST['download']}"); + $tab_array[] = array("Revision", true, "/services_acb.php?download=" . htmlspecialchars($_REQUEST['download'])); } $tab_array[] = array("Backup now", false, "/services_acb_backup.php");