From b00902e46cf3aea889e245d1ce0dfede62203dbc Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 14 Jan 2021 17:07:17 +0100
Subject: [PATCH] Firewall: add model for categories. work in progress for
 https://github.com/opnsense/core/issues/4587

escape category option values.
---
 src/www/firewall_rules_edit.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/www/firewall_rules_edit.php b/src/www/firewall_rules_edit.php
index f9c74500d..8767438fe 100644
--- a/src/www/firewall_rules_edit.php
+++ b/src/www/firewall_rules_edit.php
@@ -1217,8 +1217,9 @@ include("head.inc");
                     <td>
                       <select name="category[]" id="category" multiple="multiple" class="tokenize" data-allownew="true" data-sortable="false" data-width="334px" data-live-search="true">
 <?php
-                      foreach ((new OPNsense\Firewall\Category())->iterateCategories() as $category):?>
-                        <option value="<?=$category['name'];?>"  <?=in_array($category['name'], $pconfig['category']) ? 'selected="selected"' : '';?> ><?=$category['name'];?></option>
+                      foreach ((new OPNsense\Firewall\Category())->iterateCategories() as $category):
+                        $catname = htmlspecialchars($category['name'], ENT_QUOTES | ENT_HTML401);?>
+                        <option value="<?=$catname;?>" <?=in_array($catname, $pconfig['category']) ? 'selected="selected"' : '';?> ><?=$catname;?></option>
 <?php
                       endforeach;?>
                       </select>