webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 23:12:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

backup: Sanitise content of ADDON variable

Browse Source 
References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2018-08-30 10:28:45 +01:00
parent 7f6257e0a4
commit 614764e58a
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
html/cgi-bin/backup.cgi
View File

@@ -124,6 +124,12 @@ if ( $cgiparams{'ACTION'} eq "backup" )
}
if ( $cgiparams{'ACTION'} eq "addonbackup" )
{
# Exit if there is any dots or slashes in the addon name
exit(1) if ($cgiparams{'ADDON'} =~ /(\.|\/)/);
# Check if the addon exists
exit(1) unless (-e "/var/ipfire/backup/addons/includes/$cgiparams{'ADDON'}");
system("/usr/local/bin/backupctrl addonbackup $cgiparams{'ADDON'} >/dev/null 2>&1");
}
elsif ( $cgiparams{'ACTION'} eq "delete" )