nsinnovations/fusionpbx
2
0
Fork 0
mirror of https://github.com/fusionpbx/fusionpbx.git synced 2025-12-30 00:53:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use the escape function on name_filter to prevent XSS

Browse Source
This commit is contained in:
markjcrane
2021-07-25 08:23:11 -06:00
parent 9bb7b4e607
commit 0f34a7c732
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/basic_operator_panel/resources/content.php
View File

@@ -155,9 +155,9 @@ if (is_array($groups) && @sizeof($groups) > 0) {
}
echo " <td valign='top' nowrap='nowrap'>";
echo " <input type='hidden' id='extension_filter' value=\"".escape($_REQUEST['extension_filter'])."\">";
echo " <input type='hidden' id='name_filter' value=\"".strtolower($_REQUEST['name_filter'])."\">";
echo " <input type='hidden' id='name_filter' value=\"".strtolower(escape($_REQUEST['name_filter']))."\">";
echo " <input type='text' class='formfld' placeholder='Filter Extension' value=\"".escape($_REQUEST['extension_filter'])."\" onkeyup=\"document.getElementById('extension_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='text' class='formfld' placeholder='Filter Name' value=\"".strtolower($_REQUEST['name_filter'])."\" onkeyup=\"document.getElementById('name_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='text' class='formfld' placeholder='Filter Name' value=\"".strtolower(escape($_REQUEST['name_filter']))."\" onkeyup=\"document.getElementById('name_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='button' class='btn' title=\"Clear\" value=\"Clear\" onclick=\"document.getElementById('extension_filter').value = ''; document.getElementById('name_filter').value = '';\" ".$onhover_pause_refresh.">";
echo " </td>";
echo " </tr>";