From d23df61a498e9b8ceb45aaa3a170d614972b2696 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Wed, 18 Sep 2019 17:16:39 -0400
Subject: [PATCH] Fix some XSS issues in settings.php

Signed-off-by: Mcat12 <newtoncat12@yahoo.com>
---
 settings.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/settings.php b/settings.php
index 61b2f5d5..2406312e 100644
--- a/settings.php
+++ b/settings.php
@@ -787,7 +787,7 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "blocklists"
                                                     <div class="radio">
                                                         <label><input type="radio" name="DNSinterface" value="single"
                                                                       <?php if ($DNSinterface == "single"){ ?>checked<?php } ?>>
-                                                               <strong>Listen only on interface <?php echo $piHoleInterface; ?></strong>
+                                                               <strong>Listen only on interface <?php echo htmlentities($piHoleInterface); ?></strong>
                                                         </label>
                                                     </div>
                                                     <div class="radio">
@@ -1196,19 +1196,19 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "blocklists"
                                                 <tbody>
                                                 <tr>
                                                     <th scope="row">Pi-hole Ethernet Interface:</th>
-                                                    <td><?php echo $piHoleInterface; ?></td>
+                                                    <td><?php echo htmlentities($piHoleInterface); ?></td>
                                                 </tr>
                                                 <tr>
                                                     <th scope="row">Pi-hole IPv4 address:</th>
-                                                    <td><?php echo $piHoleIPv4; ?></td>
+                                                    <td><?php echo htmlentities($piHoleIPv4); ?></td>
                                                 </tr>
                                                 <tr>
                                                     <th scope="row">Pi-hole IPv6 address:</th>
-                                                    <td><?php echo $piHoleIPv6; ?></td>
+                                                    <td><?php echo htmlentities($piHoleIPv6); ?></td>
                                                 </tr>
                                                 <tr>
                                                     <th scope="row">Pi-hole hostname:</th>
-                                                    <td><?php echo $hostname; ?></td>
+                                                    <td><?php echo htmlentities($hostname); ?></td>
                                                 </tr>
                                                 </tbody>
                                             </table>