From 244e8ff5568c52ff73eb7bc4cfb6a596c77210ae Mon Sep 17 00:00:00 2001
From: Greg Hormann <ghormann@gmail.com>
Date: Sat, 26 Jun 2021 18:27:17 -0400
Subject: [PATCH] Prevents Cross-site scripting
 https://www.huntr.dev/bounties/1624743564895-FalconChristmas/fpp/

---
 www/backup.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/backup.php b/www/backup.php
index fa9b9bb45..1c5cd6be6 100644
--- a/www/backup.php
+++ b/www/backup.php
@@ -1970,7 +1970,7 @@ function BackupDirectionChanged() {
 
             var activeTabNumber =
 <?php
-    if (isset($_GET['tab']))
+    if (isset($_GET['tab']) and is_numeric($_GET['tab']))
         print $_GET['tab'];
     else
         print "0";