webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

ovpnclients.dat: Fixes bug 13879

Browse Source 
commit 0400a1009439d0ffeddb1e449c8bd656341f5f44
Author: Adolf Belka <adolf.belka@ipfire.org>
Date:   Thu Sep 25 13:12:39 2025 +0200

    ovpnclients.dat: Fixes bug 13879

    Fixes: bug 13879 - CONNECTION_NAME SQL Injection
    Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
    Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2025-10-10 19:21:45 +00:00
parent 61deed354b
commit 587de19dca
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
html/cgi-bin/logs.cgi/ovpnclients.dat
View File

@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2020 IPFire Team <info@ipfire.org> #
# Copyright (C) 2020 - 2025 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -141,7 +141,7 @@ my $database_query = qq(
ORDER BY common_name, duration DESC;
);
if ($cgiparams{'CONNECTION_NAME'}) {
if (($cgiparams{'CONNECTION_NAME'}) && ($cgiparams{'CONNECTION_NAME'} =~ /^[a-zA-Z0-9]+$/)) {
$database_query = qq(
SELECT common_name, DATETIME(connected_at, 'localtime'), DATETIME(disconnected_at, 'localtime'), bytes_received, bytes_sent,
STRFTIME('%s', DATETIME(disconnected_at)) - STRFTIME('%s', DATETIME(connected_at)) AS duration FROM sessions