From 116d5e29fe48efddc5249dfba5a9a2cd7c9bd356 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Sun, 27 Dec 2015 18:51:00 +0100
Subject: [PATCH] (legacy) fix sorting for firewall -> aliasses, use recursive
 html escape function on form data. closes
 https://github.com/opnsense/core/issues/573

---
 src/www/firewall_aliases.php | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/www/firewall_aliases.php b/src/www/firewall_aliases.php
index f53d2868b..b236bf402 100644
--- a/src/www/firewall_aliases.php
+++ b/src/www/firewall_aliases.php
@@ -135,6 +135,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     }
 }
 
+legacy_html_escape_form_data($a_aliases);
 $main_buttons = array(
     array('href'=>'firewall_aliases_edit.php?tab='.$selected_tab, 'label'=>gettext("Add a new alias")),
 );
@@ -190,7 +191,9 @@ $( document ).ready(function() {
                       <td>&nbsp;</td>
                     </tr>
 <?php
-                    asort($a_aliases);
+                    usort($a_aliases, function($a, $b){
+                        return strnatcmp($a['name'], $b['name']);
+                    });
                     foreach ($a_aliases as $i=> $alias){
                       $show_alias = false;
                       switch ($selected_tab){
@@ -216,7 +219,7 @@ $( document ).ready(function() {
                     ?>
                     <tr>
                       <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
-                        <?=htmlspecialchars($alias['name']);?>
+                        <?=$alias['name'];?>
                       </td>
 <?php
                         $alias_values = '';
@@ -235,10 +238,10 @@ $( document ).ready(function() {
                       }
 ?>
                       <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
-                        <?= htmlspecialchars($alias_values); ?>
+                        <?=$alias_values; ?>
                       </td>
                       <td ondblclick="document.location='firewall_aliases_edit.php?id=<?=$i;?>';">
-                        <?=htmlspecialchars($alias['descr']);?>
+                        <?=$alias['descr'];?>
                       </td>
                       <td>
                         <a href="firewall_aliases_edit.php?id=<?=$i;?>" title="<?=gettext("Edit alias"); ?>" class="btn btn-default btn-xs"><span class="glyphicon glyphicon-pencil"></span></a>