From d210dddff39462019bc9b349cb3322a92d88feca Mon Sep 17 00:00:00 2001 From: Renato Botelho Date: Fri, 14 Feb 2014 10:23:37 -0200 Subject: [PATCH] Fix #2952, escape necessary chars to avoid xss injection --- usr/local/www/system_firmware_check.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/local/www/system_firmware_check.php b/usr/local/www/system_firmware_check.php index dbd87ff547..0cf9923974 100755 --- a/usr/local/www/system_firmware_check.php +++ b/usr/local/www/system_firmware_check.php @@ -181,7 +181,7 @@ if ($g['platform'] == "nanobsd") { $txt .= " " . gettext("NanoBSD Size") . " : " . trim(file_get_contents("/etc/nanosize.txt")) . "\\n"; } $txt .= " " . gettext("Built On") .": ". $current_installed_buildtime . "\\n"; -$txt .= " " . gettext("New version") .": ". $remote_version . "\\n\\n"; +$txt .= " " . gettext("New version") .": ". addslashes($remote_version) . "\\n\\n"; $txt .= " " . gettext("Update source") .": ". $updater_url . "\\n"; update_output_window($txt); ?>