fix: sanitize extdisplay parameter to prevent XSS

[dmzoneill]

found an xss vulnerability in the web interface that could allow attackers to execute arbitrary javascript in admin sessions.

affected files

• views/devices.php (line 2)
• views/users.php (line 2)
• views/extensions.php (line 2)

vulnerability

the extdisplay request parameter is output directly into html attributes without sanitization:

data-fpbx-delete="config.php?display=devices&extdisplay=<?php echo $_REQUEST['extdisplay'] ?>&action=del"

exploit

visiting a url like:

config.php?display=devices&extdisplay=" onload="alert(document.cookie)

would execute javascript in the context of the admin session, potentially allowing session hijacking or unauthorized actions.

fix

sanitize the parameter with htmlspecialchars():

<?php echo htmlspecialchars($_REQUEST['extdisplay'], ENT_QUOTES, 'UTF-8') ?>