Minor XSS Issue

https://www.huntr.dev/bounties/1624825505923-FalconChristmas/fpp/
FalconChristmas · Jul 2, 2021 · 24adba4 · 24adba4
1 parent 9e89ae3
commit 24adba4
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/www/pluginconfig.php b/www/pluginconfig.php
@@ -1,11 +1,14 @@
 <?
 $pluginSettings = array();
 
-$pluginConfigFile = $settings['configDirectory'] . "/plugin." . $_GET['plugin'];
+$pluginName = htmlspecialchars($_GET['plugin'], ENT_QUOTES, 'UTF-8');
+
+$pluginConfigFile = $settings['configDirectory'] . "/plugin." . $pluginName;
+echo ($pluginConfigFile);
 if (file_exists($pluginConfigFile))
     $pluginSettings = parse_ini_file($pluginConfigFile);
 
-$pluginSettings['plugin'] = $_GET['plugin'];
+$pluginSettings['plugin'] = $pluginName;
 
 if (!isset($skipJSsettings))
 {