From 24adba4297da9b3110ca5f9ea13cc95617d028d2 Mon Sep 17 00:00:00 2001
From: Greg Hormann <ghormann@gmail.com>
Date: Thu, 1 Jul 2021 21:27:02 -0400
Subject: [PATCH] Minor XSS Issue
 https://www.huntr.dev/bounties/1624825505923-FalconChristmas/fpp/

---
 www/pluginconfig.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/www/pluginconfig.php b/www/pluginconfig.php
index 9dfc45afb..70b0ee26f 100644
--- a/www/pluginconfig.php
+++ b/www/pluginconfig.php
@@ -1,11 +1,14 @@
 <?
 $pluginSettings = array();
 
-$pluginConfigFile = $settings['configDirectory'] . "/plugin." . $_GET['plugin'];
+$pluginName = htmlspecialchars($_GET['plugin'], ENT_QUOTES, 'UTF-8');
+
+$pluginConfigFile = $settings['configDirectory'] . "/plugin." . $pluginName;
+echo ($pluginConfigFile);
 if (file_exists($pluginConfigFile))
     $pluginSettings = parse_ini_file($pluginConfigFile);
 
-$pluginSettings['plugin'] = $_GET['plugin'];
+$pluginSettings['plugin'] = $pluginName;
 
 if (!isset($skipJSsettings))
 {