diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2014-06-19 15:04:39 -0300 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2014-06-19 15:04:39 -0300 |
| commit | 6048cbcf1b2e2029250f9eb5fe166627c89398fd (patch) | |
| tree | 8e966bfb0d9737aa29366aed559f87ae242171c8 /config/snort/snort_import_aliases.php | |
| parent | 2092dc4865e008f703353be65f23e7389f527ab4 (diff) | |
| download | pfsense-packages-6048cbcf1b2e2029250f9eb5fe166627c89398fd.tar.gz pfsense-packages-6048cbcf1b2e2029250f9eb5fe166627c89398fd.tar.bz2 pfsense-packages-6048cbcf1b2e2029250f9eb5fe166627c89398fd.zip | |
Improve a bit user input parameters, also make sure referer starts with / to avoid sending users to external sites
Diffstat (limited to 'config/snort/snort_import_aliases.php')
| -rw-r--r-- | config/snort/snort_import_aliases.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/config/snort/snort_import_aliases.php b/config/snort/snort_import_aliases.php index 80b3bb1d..ba71c9bf 100644 --- a/config/snort/snort_import_aliases.php +++ b/config/snort/snort_import_aliases.php @@ -32,13 +32,13 @@ require_once("functions.inc"); require_once("/usr/local/pkg/snort/snort.inc"); // Retrieve any passed QUERY STRING or POST variables -if (isset($_POST['id'])) +if (isset($_POST['id']) && is_numericint($_POST['id'])) $id = $_POST['id']; elseif (isset($_GET['id']) && is_numericint($_GET['id'])) $id = htmlspecialchars($_GET['id']); if (isset($_POST['eng'])) - $eng = $_POST['eng']; + $eng = htmlspecialchars($_POST['eng']); elseif (isset($_GET['eng'])) $eng = htmlspecialchars($_GET['eng']); |