saveSettings xss

https://www.huntr.dev/bounties/1624827860695-FalconChristmas/fpp/
FalconChristmas · Jul 2, 2021 · 29301f5 · 29301f5
1 parent e07b9d0
commit 29301f5
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/www/fppjson.php b/www/fppjson.php
@@ -153,9 +153,9 @@ function SetPluginSetting()
 {
 	global $args;
 
-	$setting = $args['key'];
-	$value   = $args['value'];
-	$plugin  = $args['plugin'];
+	$setting = htmlspecialchars($args['key']);
+	$value   = htmlspecialchars($args['value']);
+	$plugin  = htmlspecialchars($args['plugin']);
 
 	check($setting, "setting", __FUNCTION__);
 	check($value, "value", __FUNCTION__);
@@ -659,8 +659,8 @@ function SetSetting()
 {
 	global $args, $SUDO;
 
-	$setting = $args['key'];
-	$value   = $args['value'];
+	$setting = htmlspecialchars($args['key']);
+	$value   = htmlspecialchars($args['value']);
 
 	check($setting, "setting", __FUNCTION__);
 	check($value, "value", __FUNCTION__);