diff --git a/html/includes/vars.inc.php b/html/includes/vars.inc.php
index 369a13a74..c9008d217 100644
--- a/html/includes/vars.inc.php
+++ b/html/includes/vars.inc.php
@@ -43,3 +43,5 @@ foreach ($_GET as $name => $value) {
foreach ($_POST as $name => $value) {
$vars[$name] = $value;
}
+
+array_walk_recursive($vars,'sanitize_array');
diff --git a/html/index.php b/html/index.php
index 46164c663..494d6c3de 100644
--- a/html/index.php
+++ b/html/index.php
@@ -214,14 +214,6 @@ else {
");
- print_r($_GET);
- print_r($vars);
- echo("");
-}
-
if ($_SESSION['authenticated']) {
// Authenticated. Print a page.
if (isset($vars['page']) && !strstr("..", $vars['page']) && is_file("pages/" . $vars['page'] . ".inc.php")) {
diff --git a/includes/common.php b/includes/common.php
index 8b59ba774..1162b819a 100644
--- a/includes/common.php
+++ b/includes/common.php
@@ -1255,3 +1255,13 @@ function get_port_id ($ports_mapped, $port, $port_association_mode) {
return $port_id;
}
+
+/**
+ * Sanitize
+ * @param mixed $item Reference to Item
+ * @param mixed $key Key
+ * @return void
+ */
+function sanitize_array(&$item, $key) {
+ $item = htmlentities($item);
+}
diff --git a/includes/dbFacile.mysql.php b/includes/dbFacile.mysql.php
index f2bb56c0b..d9372cbb6 100644
--- a/includes/dbFacile.mysql.php
+++ b/includes/dbFacile.mysql.php
@@ -266,6 +266,7 @@ function dbFetchRows($sql, $parameters=array(), $nocache=false) {
if ($config['memcached']['enable'] && $nocache === false) {
$config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$rows,$config['memcached']['ttl']);
}
+ array_walk_recursive($rows,'sanitize_array');
return $rows;
}
@@ -333,6 +334,7 @@ function dbFetchRow($sql=null, $parameters=array(), $nocache=false) {
if ($config['memcached']['enable'] && $nocache === false) {
$config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$row,$config['memcached']['ttl']);
}
+ array_walk_recursive($row,'sanitize_array');
return $row;
}
else {
diff --git a/includes/dbFacile.mysqli.php b/includes/dbFacile.mysqli.php
index 15a48962c..70c4651e7 100644
--- a/includes/dbFacile.mysqli.php
+++ b/includes/dbFacile.mysqli.php
@@ -267,6 +267,7 @@ function dbFetchRows($sql, $parameters=array(), $nocache=false) {
if ($config['memcached']['enable'] && $nocache === false) {
$config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$rows,$config['memcached']['ttl']);
}
+ array_walk_recursive($rows,'sanitize_array');
return $rows;
}
@@ -334,6 +335,7 @@ function dbFetchRow($sql=null, $parameters=array(), $nocache=false) {
if ($config['memcached']['enable'] && $nocache === false) {
$config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$row,$config['memcached']['ttl']);
}
+ array_walk_recursive($row,'sanitize_array');
return $row;
}
else {