4 ms·
it's an example.
by gonzo 10y ago
it's an example.
- rgrove 10y agoI don't mean to be combative, but when providing an example of how you're planning to mitigate vulnerabilities, it seems unwise to use code that contains an easily avoidable XSS vuln. I love pfSense and have used it for years, but this sort of thing doesn't inspire confidence.
- gonzo 10y agoUnderstood. It wasn't provided in the example, because it is not a user-entered item and is rarely displayed on the screen. It is typically an index. In other cases (perhaps) because people who originally wrote it knew no better. (There is a lot if "isnumeric()" stuff used around $id. I inherited this codebase.)