ZoneMinder
/
zoneminder
mirror of https://github.com/ZoneMinder/zoneminder.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

_monitor_filters.php: Escape MonitorName and Source. Fixes #2457

pull/2518/head
Matthew Noorenberghe 2019-02-09 19:14:31 -08:00
parent c9d597dced
commit d7ede4643d
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
web/skins/classic/views/_monitor_filters.php
View File

@ -95,7 +95,7 @@ if ( ! empty($user['MonitorIds']) ) {
}
$html .= '<span class="MonitorNameFilter"><label>'.translate('Name').'</label>';
$html .= '<input type="text" name="MonitorName" value="'.(isset($_SESSION['MonitorName'])?$_SESSION['MonitorName']:'').'" placeholder="text or regular expression"/>';
$html .= '<input type="text" name="MonitorName" value="'.(isset($_SESSION['MonitorName'])?validHtmlStr($_SESSION['MonitorName']):'').'" placeholder="text or regular expression"/>';
$html .= '</span>';
$Functions = array();
@ -160,7 +160,7 @@ $html .= htmlSelect( 'Status[]', $status_options,
$html .= '</span>';
$html .= '<span class="SourceFilter"><label>'.translate('Source').'</label>';
$html .= '<input type="text" name="Source" value="'.(isset($_SESSION['Source'])?$_SESSION['Source']:'').'" placeholder="text or regular expression"/>';
$html .= '<input type="text" name="Source" value="'.(isset($_SESSION['Source'])?validHtmlStr($_SESSION['Source']):'').'" placeholder="text or regular expression"/>';
$html .= '</span>';
$sql = 'SELECT *,S.Status AS Status, S.CaptureFPS AS CaptureFPS, S.AnalysisFPS AS AnalysisFPS, S.CaptureBandwidth AS CaptureBandwidth

2
web/skins/classic/views/montage.php
View File

@ -176,7 +176,7 @@ if ( $showZones ) {
</span>
<span id="layoutControl">
<label for="layout"><?php echo translate('Layout') ?>:</label>
<?php echo htmlSelect('zmMontageLayout', $layoutsById, $layout_id, array('onchange'=>'selectLayout(this);', 'id'=>'zmMontageLayout')); ?>
<?php echo htmlSelect('zmMontageLayout', $layoutsById, $layout_id, array('onchange'=>'selectLayout(this);')); ?>
</span>
<input type="hidden" name="Positions"/>
<input type="button" id="EditLayout" value="<?php echo translate('EditLayout') ?>" data-on-click-this="edit_layout"/>