Clean up pkg filter text before use. Fixes #12725

Also remove unnecessary echos of the value.
pfsense · Jan 25, 2022 · 5d82cce · 5d82cce
1 parent c83b195
commit 5d82cce
Showing 1 changed file with 3 additions and 6 deletions.
diff --git a/src/usr/local/www/pkg.php b/src/usr/local/www/pkg.php
@@ -434,10 +434,11 @@ function save_changes_to_xml(xml) {
 									if ($sf['name'] == $_REQUEST['pkg_filter_type']) {
 										$filter_fieldname = $sf['fieldname'];
 										#Use a default regex on sortable fields when none is declared
+										$pkg_filter = cleanup_regex_pattern(htmlspecialchars(strip_tags($_REQUEST['pkg_filter'])));
 										if ($sf['regex']) {
-											$filter_regex = str_replace("%FILTERTEXT%", $_REQUEST['pkg_filter'], trim($sf['regex']));
+											$filter_regex = str_replace("%FILTERTEXT%", $pkg_filter, trim($sf['regex']));
 										} else {
-											$filter_regex = "/{$_REQUEST['pkg_filter']}/i";
+											$filter_regex = "/{$pkg_filter}/i";
 										}
 									}
 								}
@@ -452,7 +453,6 @@ function save_changes_to_xml(xml) {
 						$fieldname = $ip[xml_safe_fieldname($column['fieldname'])];
 						if ($column['fieldname'] == $filter_fieldname) {
 							if ($filter_regex) {
-								//echo "$filter_regex - $fieldname<p/>";
 								preg_match($filter_regex, $fieldname, $filter_matches);
 								break;
 							}
@@ -603,7 +603,4 @@ function save_changes_to_xml(xml) {
 
 </form>
 <?php
-echo "<!-- filter_fieldname: {$filter_fieldname} -->";
-echo "<!-- filter_regex: {$filter_regex} -->";
-
 include("foot.inc"); ?>