From 1952de16f6f6ffc477c35640652ebe17a1859ec4 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 10 Mar 2021 19:38:42 +0100
Subject: [PATCH] system: small tweaks for #4795

---
 src/www/foot.inc                      | 2 +-
 src/www/index.php                     | 6 +++---
 src/www/widgets/include/cpu_usage.inc | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/www/foot.inc b/src/www/foot.inc
index 9c8834b99..066ae80dc 100644
--- a/src/www/foot.inc
+++ b/src/www/foot.inc
@@ -38,7 +38,7 @@
 <?php
               // XXX: ${$} is intentional here, the widgets leave global vars [widget_name]_title_link and [widget_name]_title
               if (isset(${$widgettitle})):?>
-                  <td style="cursor: pointer;" onclick='return addWidget("<?=$widgetItem['name']; ?>")'><?=$$widgettitle; ?></td>
+                  <td style="cursor: pointer;" onclick='return addWidget("<?=$widgetItem['name']; ?>")'><?= ${$widgettitle} ?></td>
 <?php
               elseif (!empty($widgetItem['display_name'])): ?>
                   <td style="cursor: pointer;" onclick='return addWidget("<?=$widgetItem['name']; ?>")'><?=$widgetItem['display_name']; ?></td>
diff --git a/src/www/index.php b/src/www/index.php
index 5680dd820..92af8d1bc 100644
--- a/src/www/index.php
+++ b/src/www/index.php
@@ -384,11 +384,11 @@ include("fbegin.inc");?>
                   <li><h3>
 <?php
                     // XXX: ${$} is intentional here, the widgets leave global vars [widget_name]_title_link and [widget_name]_title
-                    if (isset($$widgettitlelink)):?>
-                        <u><span onclick="location.href='/<?= ${$widgettitlelink} ?>'" style="cursor:pointer">
+                    if (isset(${$widgettitlelink})):?>
+                        <u><span onclick="location.href='/<?= html_safe(${$widgettitlelink}) ?>'" style="cursor:pointer">
 <?php
                     endif;
-                        echo empty($$widgettitle) ?   $widgetItem['display_name'] : ${$widgettitle};
+                        echo empty(${$widgettitle}) ? $widgetItem['display_name'] : ${$widgettitle};
                     if (isset(${$widgettitlelink})):?>
                         </span></u>
 <?php
diff --git a/src/www/widgets/include/cpu_usage.inc b/src/www/widgets/include/cpu_usage.inc
index 2765e56f5..dc87a0f34 100644
--- a/src/www/widgets/include/cpu_usage.inc
+++ b/src/www/widgets/include/cpu_usage.inc
@@ -1,4 +1,4 @@
 <?php
 
 $cpu_usage_title = gettext('CPU usage');
-$cpu_usage_title_link = 'ui/diagnostics/systemhealth/';
+$cpu_usage_title_link = 'ui/diagnostics/systemhealth';