dbxe
/
fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use the escape function on name_filter to prevent XSS

This commit is contained in:
markjcrane 2021-07-25 08:23:11 -06:00
parent 9bb7b4e607
commit 0f34a7c732
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/basic_operator_panel/resources/content.php
View File

@ -155,9 +155,9 @@ if (is_array($groups) && @sizeof($groups) > 0) {
}
echo " <td valign='top' nowrap='nowrap'>";
echo " <input type='hidden' id='extension_filter' value=\"".escape($_REQUEST['extension_filter'])."\">";
echo " <input type='hidden' id='name_filter' value=\"".strtolower($_REQUEST['name_filter'])."\">";
echo " <input type='hidden' id='name_filter' value=\"".strtolower(escape($_REQUEST['name_filter']))."\">";
echo " <input type='text' class='formfld' placeholder='Filter Extension' value=\"".escape($_REQUEST['extension_filter'])."\" onkeyup=\"document.getElementById('extension_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='text' class='formfld' placeholder='Filter Name' value=\"".strtolower($_REQUEST['name_filter'])."\" onkeyup=\"document.getElementById('name_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='text' class='formfld' placeholder='Filter Name' value=\"".strtolower(escape($_REQUEST['name_filter']))."\" onkeyup=\"document.getElementById('name_filter').value = this.value; refresh_start();\" onfocus='refresh_stop();'>\n";
echo " <input type='button' class='btn' title=\"Clear\" value=\"Clear\" onclick=\"document.getElementById('extension_filter').value = ''; document.getElementById('name_filter').value = '';\" ".$onhover_pause_refresh.">";
echo " </td>";
echo " </tr>";