Files
bpfire/html/cgi-bin/logs.cgi/config.dat
Vincent Li e44245f5fb config.dat: Fixes bug 13890
commit c431d86ab882f1305f831a37c04491a7ae771e28
Author: Adolf Belka <adolf.belka@ipfire.org>
Date:   Thu Sep 25 13:12:48 2025 +0200

    config.dat: Fixes bug 13890

    Fixes: bug 13890 - config.dat REMOTELOG_ADDR Stored Cross-Site Scripting
    Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
2025-10-09 17:28:19 +00:00

189 lines
6.6 KiB
Perl

#!/usr/bin/perl
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
use strict;
# enable only the following on debugging purpose
#use warnings;
#use CGI::Carp 'fatalsToBrowser';
require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";
my %logsettings=();
my %checked=();
my %selected=();
my $errormessage='';
&Header::showhttpheaders();
$logsettings{'LOGVIEW_REVERSE'} = 'off';
$logsettings{'LOGVIEW_VIEWSIZE'} = '150';
$logsettings{'LOGWATCH_LEVEL'} = 'Low';
$logsettings{'LOGWATCH_KEEP'} = '56';
my @VS = ('15','50','100','150','250','500');
$logsettings{'ENABLE_REMOTELOG'} = 'off';
$logsettings{'REMOTELOG_ADDR'} = '';
$logsettings{'REMOTELOG_PROTOCOL'} = 'udp';
$logsettings{'ACTION'} = '';
&Header::getcgihash(\%logsettings);
if ($logsettings{'ACTION'} eq $Lang::tr{'save'})
{
if ($logsettings{'ENABLE_REMOTELOG'} eq 'on')
{
unless ( &General::validfqdn($logsettings{'REMOTELOG_ADDR'}) ||
&General::validip ($logsettings{'REMOTELOG_ADDR'}))
{
$errormessage = $Lang::tr{'invalid logserver address'};
}
unless ($logsettings{'REMOTELOG_PROTOCOL'} =~ /^udp|tcp$/)
{
$errormessage = $Lang::tr{'invalid logserver protocol'};
}
}
unless ($logsettings{'LOGWATCH_KEEP'} =~ /^\d+$/)
{
$errormessage = $Lang::tr{'invalid keep time'};
}
unless ($logsettings{'LOGWATCH_LEVEL'} =~ /^Low|Med|High$/)
{
$errormessage = $Lang::tr{'invalid input'};
}
unless ($errormessage)
{
&General::writehash("${General::swroot}/logging/settings", \%logsettings);
system('/usr/local/bin/syslogdctrl') == 0
or $errormessage = "$Lang::tr{'bad return code'} " . $?/256;
}
}
&General::readhash("${General::swroot}/logging/settings", \%logsettings);
$checked{'ENABLE_REMOTELOG'}{'off'} = '';
$checked{'ENABLE_REMOTELOG'}{'on'} = '';
$checked{'ENABLE_REMOTELOG'}{$logsettings{'ENABLE_REMOTELOG'}} = "checked='checked'";
$selected{'REMOTELOG_PROTOCOL'}{'udp'} = '';
$selected{'REMOTELOG_PROTOCOL'}{'tcp'} == '';
$selected{'REMOTELOG_PROTOCOL'}{$logsettings{'REMOTELOG_PROTOCOL'}} = "selected='selected'";
$checked{'LOGVIEW_REVERSE'}{'off'} = '';
$checked{'LOGVIEW_REVERSE'}{'on'} = '';
$checked{'LOGVIEW_REVERSE'}{$logsettings{'LOGVIEW_REVERSE'}} = "checked='checked'";
$selected{'LOGWATCH_LEVEL'}{'Low'} = '';
$selected{'LOGWATCH_LEVEL'}{'Med'} = '';
$selected{'LOGWATCH_LEVEL'}{'High'} = '';
$selected{'LOGWATCH_LEVEL'}{$logsettings{'LOGWATCH_LEVEL'}} = "selected='selected'";
map ($selected{'LOGVIEW_VIEWSIZE'}{$_} = '', @VS);
$selected{'LOGVIEW_VIEWSIZE'}{$logsettings{'LOGVIEW_VIEWSIZE'}} = "selected='selected'";
&Header::openpage($Lang::tr{'log settings'}, 1, '');
&Header::openbigbox('100%', 'left', '', $errormessage);
if ($errormessage) {
&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
print "<font class='base'>$errormessage&nbsp;</font>\n";
&Header::closebox();
}
print "<form method='post' action='$ENV{'SCRIPT_NAME'}'>\n";
&Header::openbox('100%', 'left', $Lang::tr{'log viewing options'});
print <<END
<table width='100%'>
<tr>
<td><input type='checkbox' name='LOGVIEW_REVERSE' $checked{'LOGVIEW_REVERSE'}{'on'} /></td>
<td class='base' width='50%'>$Lang::tr{'reverse sort'}</td>
<td class='base' width='25%' align='right'>$Lang::tr{'log lines per page'}:&nbsp;</td>
<td width='25%'><select name='LOGVIEW_VIEWSIZE'>
END
;
foreach my $vs (@VS) {
print "\t<option value='$vs' $selected{'LOGVIEW_VIEWSIZE'}{$vs}>$vs</option>\n";
}
print <<END
</select></td>
</tr>
</table>
END
;
&Header::closebox();
&Header::openbox('100%', 'left', $Lang::tr{'log summaries'});
print <<END
<table width='100%'>
<tr>
<td class='base' width='50%'>$Lang::tr{'summaries kept'}&nbsp;
<input type='text' name='LOGWATCH_KEEP'
value='$logsettings{'LOGWATCH_KEEP'}' size='4' />&nbsp;$Lang::tr{'days'}</td>
<td>$Lang::tr{'detail level'}:</td><td>
<select name='LOGWATCH_LEVEL'>
<option value='Low' $selected{'LOGWATCH_LEVEL'}{'Low'}>$Lang::tr{'low'}</option>
<option value='Med' $selected{'LOGWATCH_LEVEL'}{'Med'}>$Lang::tr{'medium'}</option>
<option value='High' $selected{'LOGWATCH_LEVEL'}{'High'}>$Lang::tr{'high'}</option>
</select></td>
</tr>
</table>
END
;
&Header::closebox();
&Header::openbox('100%', 'left', $Lang::tr{'remote logging'});
$logsettings{'REMOTELOG_ADDR'} = &Header::escape($logsettings{'REMOTELOG_ADDR'});
print <<END
<table width='100%'>
<tr>
<td class='base'>$Lang::tr{'enabled'}</td><td><input type='checkbox' name='ENABLE_REMOTELOG' $checked{'ENABLE_REMOTELOG'}{'on'} /></td>
<td>$Lang::tr{'log server address'}</td><td><input type='text' name='REMOTELOG_ADDR' value='$logsettings{'REMOTELOG_ADDR'}' /></td>
<td>$Lang::tr{'log server protocol'}</td><td>
<select name='REMOTELOG_PROTOCOL'>
<option value='udp' $selected{'REMOTELOG_PROTOCOL'}{'udp'}>$Lang::tr{'udp less overhead'}</option>
<option value='tcp' $selected{'REMOTELOG_PROTOCOL'}{'tcp'}>$Lang::tr{'tcp more reliable'}</option>
</select></td>
</tr>
</table>
END
;
&Header::closebox();
print <<END
<div align='center'>
<table width='60%'>
<tr>
<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
</tr>
</table>
</div>
END
;
print "</form>\n";
&Header::closebigbox();
&Header::closepage();