Fix improperly escaped output in outages page (#15310)

Fixes XSS reported by https://huntr.dev/users/hainguyen0207
This commit is contained in:
Tony Murray
2023-09-13 23:10:37 -05:00
committed by GitHub
parent a1eb90fe69
commit 49d66fa31b

View File

@ -39,8 +39,8 @@ var outages_grid = $("#outages").bootgrid({
{
return {
device: ' . (empty($vars['device']) ? 'null' : (int) $vars['device']) . ',
to: "' . addcslashes($vars['to'], '"') . '",
from: "' . addcslashes($vars['from'], '"') . '",
to: "' . htmlspecialchars($vars['to']) . '",
from: "' . htmlspecialchars($vars['from']) . '",
};
},
url: "' . url('/ajax/table/outages') . '"