dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape user data (#3088)

Browse Source 
* Escape user data on extension_edit.php

* Escape user data on gateway_edit.php

* Escape user data on user_edit.php
This commit is contained in:
AlexanderDCrane
2018-06-08 14:44:21 -06:00
committed by FusionPBX
parent 9a8f3dfcc2
commit 1dcb16ce1d
2 changed files with 64 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/gateways/gateway_edit.php
+26 -26
View File
@@ -368,7 +368,7 @@
echo " <td width='50%' align='right'>\n";
echo " <input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='gateways.php'\" value='".$text['button-back']."'>\n";
if ($action == "update") {
echo " <input type='button' class='btn' name='' alt='".$text['button-copy']."' onclick=\"if (confirm('".$text['confirm-copy']."')){window.location='gateway_copy.php?id=".$gateway_uuid."';}\" value='".$text['button-copy']."'>\n";
echo " <input type='button' class='btn' name='' alt='".$text['button-copy']."' onclick=\"if (confirm('".$text['confirm-copy']."')){window.location='gateway_copy.php?id=".".escape($gateway_uuid)."."';}\" value='".$text['button-copy']."'>\n";
}
echo " <input type='button' class='btn' value='".$text['button-save']."' onclick='submit_form();'>\n";
echo " </td>\n";
@@ -389,7 +389,7 @@
echo " ".$text['label-gateway']."\n";
echo "</td>\n";
echo "<td width=\"70%\" class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='gateway' maxlength='255' value=\"$gateway\" required='required'>\n";
echo " <input class='formfld' type='text' name='gateway' maxlength='255' value=\"".escape($gateway)."\" required='required'>\n";
echo "<br />\n";
echo $text['description-gateway-name']."\n";
echo "</td>\n";
@@ -400,7 +400,7 @@
echo " ".$text['label-username']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='username' maxlength='255' autocomplete='off' value=\"$username\">\n";
echo " <input class='formfld' type='text' name='username' maxlength='255' autocomplete='off' value=\"".escape($username)."\">\n";
echo "<br />\n";
echo $text['description-username']."\n";
echo "</td>\n";
@@ -411,7 +411,7 @@
echo " ".$text['label-password']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='password' name='password' id='password' autocomplete='off' maxlength='255' onmouseover=\"this.type='text';\" onfocus=\"this.type='text';\" onmouseout=\"if (!$(this).is(':focus')) { this.type='password'; }\" onblur=\"this.type='password';\" value=\"$password\">\n";
echo " <input class='formfld' type='password' name='password' id='password' autocomplete='off' maxlength='255' onmouseover=\"this.type='text';\" onfocus=\"this.type='text';\" onmouseout=\"if (!$(this).is(':focus')) { this.type='password'; }\" onblur=\"this.type='password';\" value=\"".escape($password)."\">\n";
echo " <br />\n";
echo " ".$text['description-password']."\n";
echo "</td>\n";
@@ -422,7 +422,7 @@
echo " ".$text['label-from_user']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='from_user' maxlength='255' value=\"$from_user\">\n";
echo " <input class='formfld' type='text' name='from_user' maxlength='255' value=\"".escape($from_user)."\">\n";
echo "<br />\n";
echo $text['description-from_user']."\n";
echo "</td>\n";
@@ -433,7 +433,7 @@
echo " ".$text['label-from_domain']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='from_domain' maxlength='255' value=\"$from_domain\">\n";
echo " <input class='formfld' type='text' name='from_domain' maxlength='255' value=\"".escape($from_domain)."\">\n";
echo "<br />\n";
echo $text['description-from_domain']."\n";
echo "</td>\n";
@@ -444,7 +444,7 @@
echo " ".$text['label-proxy']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='proxy' maxlength='255' value=\"$proxy\" required='required'>\n";
echo " <input class='formfld' type='text' name='proxy' maxlength='255' value=\"".escape($proxy)."\" required='required'>\n";
echo "<br />\n";
echo $text['description-proxy']."\n";
echo "</td>\n";
@@ -455,7 +455,7 @@
echo " ".$text['label-realm']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='realm' maxlength='255' value=\"$realm\">\n";
echo " <input class='formfld' type='text' name='realm' maxlength='255' value=\"".escape($realm)."\">\n";
echo "<br />\n";
echo $text['description-realm']."\n";
echo "</td>\n";
@@ -467,7 +467,7 @@
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
if (strlen($expire_seconds) == 0) { $expire_seconds = "800"; }
echo " <input class='formfld' type='number' name='expire_seconds' maxlength='255' value='$expire_seconds' min='1' max='65535' step='1' required='required'>\n";
echo " <input class='formfld' type='number' name='expire_seconds' maxlength='255' value='".escape($expire_seconds)."' min='1' max='65535' step='1' required='required'>\n";
echo "<br />\n";
echo $text['description-expire_seconds']."\n";
echo "</td>\n";
@@ -502,7 +502,7 @@
echo " ".$text['label-retry_seconds']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='number' name='retry_seconds' maxlength='255' value='$retry_seconds' min='1' max='65535' step='1' required='required'>\n";
echo " <input class='formfld' type='number' name='retry_seconds' maxlength='255' value='".escape($retry_seconds)."' min='1' max='65535' step='1' required='required'>\n";
echo "<br />\n";
echo $text['description-retry_seconds']."\n";
echo "</td>\n";
@@ -556,7 +556,7 @@
echo " ".$text['label-auth_username']."\n";
echo "</td>\n";
echo "<td width='70%' class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='auth_username' maxlength='255' value=\"$auth_username\">\n";
echo " <input class='formfld' type='text' name='auth_username' maxlength='255' value=\"".escape($auth_username)."\">\n";
echo "<br />\n";
echo $text['description-auth_username']."\n";
echo "</td>\n";
@@ -567,7 +567,7 @@
echo " ".$text['label-extension']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='extension' maxlength='255' value=\"$extension\">\n";
echo " <input class='formfld' type='text' name='extension' maxlength='255' value=\"".escape($extension)."\">\n";
echo "<br />\n";
echo $text['description-extension']."\n";
echo "</td>\n";
@@ -609,7 +609,7 @@
echo " ".$text['label-register_proxy']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='register_proxy' maxlength='255' value=\"$register_proxy\">\n";
echo " <input class='formfld' type='text' name='register_proxy' maxlength='255' value=\"".escape($register_proxy)."\">\n";
echo "<br />\n";
echo $text['description-register_proxy']."\n";
echo "</td>\n";
@@ -620,7 +620,7 @@
echo " ".$text['label-outbound_proxy']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='outbound_proxy' maxlength='255' value=\"$outbound_proxy\">\n";
echo " <input class='formfld' type='text' name='outbound_proxy' maxlength='255' value=\"".escape($outbound_proxy)."\">\n";
echo "<br />\n";
echo $text['description-outbound_proxy']."\n";
echo "</td>\n";
@@ -681,7 +681,7 @@
echo " ".$text['label-sip_cid_type']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='sip_cid_type' maxlength='255' value=\"$sip_cid_type\" pattern='^(none|pid|rpid)$'>\n";
echo " <input class='formfld' type='text' name='sip_cid_type' maxlength='255' value=\"".escape($sip_cid_type)."\" pattern='^(none|pid|rpid)$'>\n";
echo "<br />\n";
echo $text['description-sip_cid_type']."\n";
echo "</td>\n";
@@ -692,7 +692,7 @@
echo " ".$text['label-codec_prefs']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='codec_prefs' maxlength='255' value=\"$codec_prefs\">\n";
echo " <input class='formfld' type='text' name='codec_prefs' maxlength='255' value=\"".escape($codec_prefs)."\">\n";
echo "<br />\n";
echo $text['description-codec_prefs']."\n";
echo "</td>\n";
@@ -728,7 +728,7 @@
echo " ".$text['label-ping']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='number' name='ping' maxlength='255' min='1' max='65535' step='1' value=\"$ping\">\n";
echo " <input class='formfld' type='number' name='ping' maxlength='255' min='1' max='65535' step='1' value=\"".escape($ping)."\">\n";
echo "<br />\n";
echo $text['description-ping']."\n";
echo "</td>\n";
@@ -740,7 +740,7 @@
echo " ".$text['label-channels']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='number' name='channels' maxlength='255' value=\"$channels\" min='0' max='65535' step='1'>\n";
echo " <input class='formfld' type='number' name='channels' maxlength='255' value=\"".escape($channels)."\" min='0' max='65535' step='1'>\n";
echo "<br />\n";
echo $text['description-channels']."\n";
echo "</td>\n";
@@ -752,7 +752,7 @@
echo " ".$text['label-hostname']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='hostname' maxlength='255' value=\"$hostname\">\n";
echo " <input class='formfld' type='text' name='hostname' maxlength='255' value=\"".escape($hostname)."\">\n";
echo "<br />\n";
echo $text['description-hostname']."\n";
echo "</td>\n";
@@ -773,10 +773,10 @@
}
foreach ($_SESSION['domains'] as $row) {
if ($row['domain_uuid'] == $domain_uuid) {
echo " <option value='".$row['domain_uuid']."' selected='selected'>".$row['domain_name']."</option>\n";
echo " <option value='".escape($row['domain_uuid'])."' selected='selected'>".escape($row['domain_name'])."</option>\n";
}
else {
echo " <option value='".$row['domain_uuid']."'>".$row['domain_name']."</option>\n";
echo " <option value='".escape($row['domain_uuid'])."'>".escape($row['domain_name'])."</option>\n";
}
}
echo " </select>\n";
@@ -799,7 +799,7 @@
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
if (strlen($context) == 0) { $context = "public"; }
echo " <input class='formfld' type='text' name='context' maxlength='255' value=\"$context\">\n";
echo " <input class='formfld' type='text' name='context' maxlength='255' value=\"".escape($context)."\">\n";
echo "<br />\n";
echo $text['description-context']."\n";
echo "</td>\n";
@@ -814,10 +814,10 @@
foreach ($sip_profiles as $row) {
$sip_profile_name = $row["sip_profile_name"];
if ($profile == $sip_profile_name) {
echo " <option value='$sip_profile_name' selected='selected'>".$sip_profile_name."</option>\n";
echo " <option value='$sip_profile_name' selected='selected'>".escape($sip_profile_name)."</option>\n";
}
else {
echo " <option value='$sip_profile_name'>".$sip_profile_name."</option>\n";
echo " <option value='".escape($sip_profile_name)."'>".escape($sip_profile_name)."</option>\n";
}
}
echo " </select>\n";
@@ -855,7 +855,7 @@
echo " ".$text['label-description']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='description' maxlength='255' value=\"$description\">\n";
echo " <input class='formfld' type='text' name='description' maxlength='255' value=\"".escape($description)."\">\n";
echo "<br />\n";
echo $text['description-description']."\n";
echo "</td>\n";
@@ -864,7 +864,7 @@
echo " <tr>\n";
echo " <td colspan='2' align='right'>\n";
if ($action == "update") {
echo " <input type='hidden' name='gateway_uuid' value='$gateway_uuid'>\n";
echo " <input type='hidden' name='gateway_uuid' value='".escape($gateway_uuid)."'>\n";
}
echo " <br>";
echo " <input type='button' class='btn' value='".$text['button-save']."' onclick='submit_form();'>\n";