Revision 0e6cf71b
Added by Renato Botelho over 11 years ago
| usr/local/www/firewall_rules_edit.php | ||
|---|---|---|
| 81 | 81 |
filter_rules_sort(); |
| 82 | 82 |
$a_filter = &$config['filter']['rule']; |
| 83 | 83 |
|
| 84 |
$id = $_GET['id']; |
|
| 85 |
if (is_numeric($_POST['id'])) |
|
| 84 |
if (is_numericint($_GET['id'])) |
|
| 85 |
$id = $_GET['id']; |
|
| 86 |
if (isset($_POST['id']) && is_numericint($_POST['id'])) |
|
| 86 | 87 |
$id = $_POST['id']; |
| 87 | 88 |
|
| 88 |
$after = $_GET['after'];
|
|
| 89 |
|
|
| 90 |
if (isset($_POST['after'])) |
|
| 89 |
if (is_numericint($_GET['after']))
|
|
| 90 |
$after = $_GET['after']; |
|
| 91 |
if (isset($_POST['after']) && is_numericint($_GET['after']))
|
|
| 91 | 92 |
$after = $_POST['after']; |
| 92 | 93 |
|
| 93 |
if (isset($_GET['dup'])) {
|
|
| 94 |
$id = $_GET['dup'];
|
|
| 95 |
$after = $_GET['dup'];
|
|
| 94 |
if (isset($_GET['dup']) && is_numericint($_GET['dup'])) {
|
|
| 95 |
$id = $_GET['dup'];
|
|
| 96 |
$after = $_GET['dup'];
|
|
| 96 | 97 |
} |
| 97 | 98 |
|
| 98 | 99 |
if (isset($id) && $a_filter[$id]) {
|
| ... | ... | |
| 202 | 203 |
$pconfig['sched'] = (($a_filter[$id]['sched'] == "none") ? '' : $a_filter[$id]['sched']); |
| 203 | 204 |
$pconfig['vlanprio'] = (($a_filter[$id]['vlanprio'] == "none") ? '' : $a_filter[$id]['vlanprio']); |
| 204 | 205 |
$pconfig['vlanprioset'] = (($a_filter[$id]['vlanprioset'] == "none") ? '' : $a_filter[$id]['vlanprioset']); |
| 205 |
if (!isset($_GET['dup'])) |
|
| 206 |
if (!isset($_GET['dup']) || !is_numericint($_GET['dup']))
|
|
| 206 | 207 |
$pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; |
| 207 | 208 |
|
| 208 | 209 |
} else {
|
| ... | ... | |
| 216 | 217 |
/* Allow the FloatingRules to work */ |
| 217 | 218 |
$if = $pconfig['interface']; |
| 218 | 219 |
|
| 219 |
if (isset($_GET['dup'])) |
|
| 220 |
if (isset($_GET['dup']) && is_numericint($_GET['dup']))
|
|
| 220 | 221 |
unset($id); |
| 221 | 222 |
|
| 222 | 223 |
read_altq_config(); /* XXX: */ |
Also available in: Unified diff
Improve checks for params 'id', 'dup' and other similar ones to make sure they are numeric integer, also, pass them through htmlspecialchars() before print