Actions
Bug #5877
closed
firewall_shaper_vinterface.php and firewall_shaper_layer7.php: Parameters are printed without escaping
Start date:
02/10/2016
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All
Description
On firewall_shaper_vinterface.php and firewall_shaper_layer7.php many parameters are printed without escaping. Notably the "newname" parameter on limiters and "container" on Layer 7, though others are affected. Lumping these into one ticket because they share a common backend in shaper.inc on 2.2.x.
Input validation prevents the bad values from being stored, but the invalid values are echoed back to the user without encoding.
2.3 is not affected by any of these (Especially the L7 one which has been removed).
Updated by Jim Pingle over 9 years ago
- Status changed from Assigned to Feedback
- % Done changed from 0 to 100
Applied in changeset b76fd2a05664379c6752c5ee28c42462348d5d51.
Updated by Jim Pingle over 9 years ago
- Status changed from Feedback to Resolved
Additional feedback from the original reporter confirms the internal testing results that this has been fixed.
Actions