Project

General

Profile

Bug #3127 » pkg_edit.diff

Patch for pkg_edit.php to fix reported issue - Jörg Schneider, 08/03/2013 04:10 AM

View differences:

/usr/local/www/pkg_edit.php 2013-08-03 09:43:59.000000000 +0200
519 519
		switch($pkga['type']){
520 520
			case "input":
521 521
				$size = ($pkga['size'] ? " size='{$pkga['size']}' " : "");
522
				$input = "<input {$size} id='{$pkga['fieldname']}' name='{$pkga['fieldname']}' class='formfld unknown' value='" . htmlspecialchars($value) ."' />\n";
522
				$input = "<input {$size} id='{$pkga['fieldname']}' name='{$pkga['fieldname']}' class='formfld unknown' value='" . htmlspecialchars($value, ENT_QUOTES) ."' />\n";
523 523
				$input .= "<br/>" . fixup_string($pkga['description']) . "\n";
524 524
				if(isset($pkga['advancedfield']) && isset($adv_filed_count)) {
525 525
					$js_array[] = $pkga['fieldname'];
......
531 531

  
532 532
			case "password":
533 533
				$size = ($pkga['size'] ? " size='{$pkga['size']}' " : "");
534
				$input = "<input " . $size . " id='" . $pkga['fieldname'] . "' type='password' name='" . $pkga['fieldname'] . "' class='formfld pwd' value='" . htmlspecialchars($value) . "' />\n";
534
				$input = "<input " . $size . " id='" . $pkga['fieldname'] . "' type='password' name='" . $pkga['fieldname'] . "' class='formfld pwd' value='" . htmlspecialchars($value, ENT_QUOTES) . "' />\n";
535 535
				$input .= "<br/>" . fixup_string($pkga['description']) . "\n";
536 536
				if(isset($pkga['advancedfield']) && isset($adv_filed_count)) {
537 537
					$js_array[] = $pkga['fieldname'];
......
967 967
	echo "<td>\n";
968 968
	switch($type){
969 969
		case "input":
970
			echo "<input size='{$size}' name='{$fieldname}{$trc}' id='{$fieldname}{$trc}' class='formfld unknown' value='" . htmlspecialchars($value) . "' />\n";
970
			echo "<input size='{$size}' name='{$fieldname}{$trc}' id='{$fieldname}{$trc}' class='formfld unknown' value='" . htmlspecialchars($value, ENT_QUOTES) . "' />\n";
971 971
			break;
972 972
		case "checkbox":
973 973
			echo "<input size='{$size}' type='checkbox' id='{$fieldname}{$trc}' name='{$fieldname}{$trc}' value='ON' ".($value?"CHECKED":"")." />\n";
974 974
			break;
975 975
		case "password":
976
			echo "<input size='{$size}' type='password' id='{$fieldname}{$trc}' name='{$fieldname}{$trc}' class='formfld pwd' value='" . htmlspecialchars($value) . "' />\n";
976
			echo "<input size='{$size}' type='password' id='{$fieldname}{$trc}' name='{$fieldname}{$trc}' class='formfld pwd' value='" . htmlspecialchars($value, ENT_QUOTES) . "' />\n";
977 977
			break;
978 978
		case "textarea":
979 979
			echo "<textarea rows='2' cols='12' id='{$fieldname}{$trc}' class='formfld unknown' name='{$fieldname}{$trc}'>{$value}</textarea>\n";
    (1-1/1)