Encoding for haproxy_listeners.php. Fixes #9335

Encode desc and table_actionsaclN before output. (cherry picked from commit 3b40366)
pfsense · Feb 18, 2019 · 2dded47 · 2dded47
1 parent 25c8753
commit 2dded47
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 6 deletions.
diff --git a/net/pfSense-pkg-haproxy-devel/Makefile b/net/pfSense-pkg-haproxy-devel/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	pfSense-pkg-haproxy-devel
 PORTVERSION=	0.59
-PORTREVISION=	16
+PORTREVISION=	17
 CATEGORIES=	net
 MASTER_SITES=	# empty
 DISTFILES=	# empty

diff --git a/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php b/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php
@@ -367,7 +367,7 @@ function sort_sharedfrontends(&$a, &$b) {
 					<?=$frontend['name'];?>
 				  </td>
 				  <td>
-					<?=$frontend['desc'];?>
+					<?=htmlspecialchars($frontend['desc']);?>
 				  </td>
 				  <td>
 				    <?php
@@ -412,7 +412,7 @@ function sort_sharedfrontends(&$a, &$b) {
 							echo "<div title='{$hint}'>";
 							echo "<a href='haproxy_pool_edit.php?id={$backend}'>{$backend}</a>";
 							if (!empty($actionitem['acl'])) {
-								echo "&nbsp;if({$actionitem['acl']})";
+								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
 							}
 							echo "<br/></div>";
 						}

diff --git a/net/pfSense-pkg-haproxy/Makefile b/net/pfSense-pkg-haproxy/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	pfSense-pkg-haproxy
 PORTVERSION=	0.59
-PORTREVISION=	15
+PORTREVISION=	16
 CATEGORIES=	net
 MASTER_SITES=	# empty
 DISTFILES=	# empty

diff --git a/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php b/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
@@ -367,7 +367,7 @@ function sort_sharedfrontends(&$a, &$b) {
 					<?=$frontend['name'];?>
 				  </td>
 				  <td>
-					<?=$frontend['desc'];?>
+					<?=htmlspecialchars($frontend['desc']);?>
 				  </td>
 				  <td>
 				    <?php
@@ -412,7 +412,7 @@ function sort_sharedfrontends(&$a, &$b) {
 							echo "<div title='{$hint}'>";
 							echo "<a href='haproxy_pool_edit.php?id={$backend}'>{$backend}</a>";
 							if (!empty($actionitem['acl'])) {
-								echo "&nbsp;if({$actionitem['acl']})";
+								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
 							}
 							echo "<br/></div>";
 						}