From f95d6bdc1910690eb90b94227626f2db188a69ba Mon Sep 17 00:00:00 2001 From: Phil Davis Date: Fri, 17 Mar 2017 11:26:48 +0545 Subject: [PATCH] No need to check for HTML in NAT 1to1 or NAT Out descr --- src/usr/local/www/firewall_nat_1to1_edit.php | 4 ++++ src/usr/local/www/firewall_nat_out_edit.php | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/usr/local/www/firewall_nat_1to1_edit.php b/src/usr/local/www/firewall_nat_1to1_edit.php index e27d433d84..d16f4cece1 100644 --- a/src/usr/local/www/firewall_nat_1to1_edit.php +++ b/src/usr/local/www/firewall_nat_1to1_edit.php @@ -104,6 +104,10 @@ if ($_POST['save']) { * cannot think he is slick and perform a XSS attack on the unwilling */ foreach ($_POST as $key => $value) { + if ($key == 'descr') { + continue; + } + $temp = str_replace(">", "", $value); $newpost = htmlentities($temp); diff --git a/src/usr/local/www/firewall_nat_out_edit.php b/src/usr/local/www/firewall_nat_out_edit.php index 92f90608b9..9858391daa 100644 --- a/src/usr/local/www/firewall_nat_out_edit.php +++ b/src/usr/local/www/firewall_nat_out_edit.php @@ -146,6 +146,10 @@ if ($_POST['save']) { * cannot think he is slick and perform a XSS attack on the unwilling */ foreach ($_POST as $key => $value) { + if ($key == 'descr') { + continue; + } + $temp = str_replace(">", "", $value); $newpost = htmlentities($temp); if ($newpost <> $temp) {