webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 23:12:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

wsdd: Securely parse the workgroup name

Browse Source 
Because of a single variable being passwd with the workgroup, it would
have been possible to inject shell commands here. Passing it in the
array prevents that.

Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
This commit is contained in:
Michael Tremer
2024-01-11 16:11:53 +01:00
committed by Daniel Weismüller
parent bb88fd1b69
commit 43c2dc9318
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/initscripts/packages/wsdd
View File

@@ -38,18 +38,20 @@ ARGS=(
# Only use IPv4
"--ipv4only"
# Configure the workgroup
"--workgroup" "$(testparm -s --parameter-name workgroup 2>/dev/null)"
)
INTERFACES="--interface ${GREEN_DEV}"
if [ -n "${BLUE_DEV}" ]; then
INTERFACES="${INTERFACES} --interface ${BLUE_DEV}"
fi
WSDD_WORKGROUP="--workgroup $(/usr/bin/testparm -s --parameter-name workgroup 2>/dev/null)"
case "$1" in
start)
boot_mesg "Starting wsdd daemon..."
loadproc -b -p "${PIDFILE}" /usr/bin/wsdd "${ARGS[@]}" ${INTERFACES} ${WSDD_WORKGROUP}
loadproc -b -p "${PIDFILE}" /usr/bin/wsdd "${ARGS[@]}" ${INTERFACES}
;;
stop)