Michael Tremer 0aff7b8196 {proxy,chpasswd}.cgi: Fix a remote code execution vulnerability ...

Handcrafted requests with shell commands could be sent to these
CGI files and gain shell access as unprivileged user.

References: #11087

Reported-by: Yann Cam <yann.cam@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

2016-04-08 15:54:53 +01:00

..

asterisk

Made some nicer graphs and fixes

2008-02-05 19:22:05 +00:00

logs.cgi

No code changes, fixed formatting by replacing spaces with tabs

2016-01-09 20:09:58 +01:00

aliases.cgi

aliases.cgi: Mark name field as mandatory.

2014-04-09 14:19:16 +02:00

atm-status.cgi

atm-status.cgi: display more values for solos-pci.

2014-02-15 16:41:40 +01:00

backup.cgi

deleted title of backup.cgi

2014-01-09 16:50:46 +01:00

bluetooth.cgi

Add bluetooth.cgi only rfcomm/modem support yet

2008-08-16 17:44:44 +02:00

chpasswd.cgi

{proxy,chpasswd}.cgi: Fix a remote code execution vulnerability

2016-04-08 15:54:53 +01:00

connections.cgi

connections.cgi: Fix page crash with IPsec connections with one subnet only

2015-12-12 09:50:19 +00:00

connscheduler.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

country.cgi

country.cgi: Rework script.

2015-05-12 20:41:35 +02:00

credits.cgi

credits.cgi: Update credits

2015-10-31 21:41:58 +00:00

ddns.cgi

ddns.cgi: Use ddnsctrl for instant update.

2015-04-26 16:52:52 +02:00

dhcp.cgi

dhcp rfc2136: dhcpd does not seem to support SHA-1

2015-10-21 17:34:41 +01:00

dns.cgi

Change that iptv-mac field could also empty for save

2009-10-06 21:09:52 +02:00

dnsforward.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

entropy.cgi

entropy.cgi: Show status of rngd.

2014-04-29 13:09:42 +02:00

extrahd.cgi

cgi-bin: Add title attribute to input type image where missing

2014-02-19 18:31:02 +01:00

fireinfo.cgi

cgi-bin: Use readonly="readonly" attribute on html input elements

2014-02-18 18:48:57 +01:00

firewall.cgi

BUG10940: remove leading zeros in ip address

2015-11-09 17:32:59 +00:00

fwhosts.cgi

BUG10940: remove leading zeros in ip address

2015-11-09 17:32:59 +00:00

geoip-block.cgi

geoip-block.cgi: Finish column after last element and uneven amount of items.

2015-05-12 20:39:44 +02:00

gpl.cgi

gpl.cgi: Fix proper redirection so that the agreement has only to be accepted once.

2014-03-05 23:53:21 +01:00

gui.cgi

gui.cgi: htmlcleanup, change html tags from uppercase to lowercase

2014-02-15 15:51:41 +01:00

hardwaregraphs.cgi

Fix block device detection for graphs and other scripts.

2012-01-16 22:22:17 +01:00

hosts.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

ids.cgi

snort: Update to 2.9.7.6

2015-11-04 21:18:56 +00:00

imspector.cgi

cgi-bin and themes: Remove language attribute on script tag

2014-02-15 16:11:45 +01:00

index.cgi

index.cgi: Hide blue and green if not enabled

2015-04-22 13:06:52 +02:00

ipinfo.cgi

ipinfo.cgi: Remove XSS vulnerability

2016-04-08 15:54:53 +01:00

iptables.cgi

iptables.cgi: htmlcleanup, change html tags from uppercase to lowercase

2014-02-15 15:51:41 +01:00

mac.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

mail.cgi

BUG10964: When entering wrong data in dma setup, the fields are blanked

2015-11-10 18:38:56 +00:00

mdstat.cgi

cgi-bin: Use readonly="readonly" attribute on html input elements

2014-02-18 18:48:57 +01:00

media.cgi

media.cgi: Add missing 'tr'.

2014-04-12 12:18:57 +02:00

memory.cgi

Some Fixes for the CGIs not spamming apache logfile.

2010-12-12 20:40:56 +01:00

modem-status.cgi

modem-status: add more ttyUSB and ttyACM ports.

2014-06-06 10:45:59 +02:00

modem.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

mpfire.cgi

MPFire: Split page into three subpages.

2009-10-27 23:49:03 +01:00

netexternal.cgi

netexternal.cgi: Fix font colour on yellow background.

2014-07-16 23:25:06 +02:00

netinternal.cgi

Multiple CGI files: Check if BLUE or ORANGE are actually configured.

2013-11-08 14:32:08 +01:00

netother.cgi

This fixes the ping graphs, since new collectd rrds we need to filter exact.

2010-03-13 21:09:07 +01:00

netovpnrw.cgi

vpn-statistic: add URI::escape for openvpn names with special chars

2015-04-14 14:00:47 +02:00

netovpnsrv.cgi

Core90: make N2N Graphs higher to them correctly

2015-05-03 05:12:13 +02:00

optionsfw.cgi

firewall options: Fix translation and spelling of new ALG section

2015-08-20 23:05:40 +01:00

ovpnmain.cgi

openvpn: Update to version 2.3.7, added --verify-x509-name directive.

2016-01-04 22:41:46 +00:00

p2p-block.cgi

cgi-bin: HTML cleanup, add quotes for attribute values

2014-02-15 16:54:38 +01:00

pakfire.cgi

BUG10796: Fix textoutput when doing pakfire update in WebUI

2015-04-13 07:52:25 +02:00

pppsetup.cgi

pppsetup.cgi: Fix site layout when no TYPE is specified

2015-10-18 18:51:31 +01:00

proxy.cgi

{proxy,chpasswd}.cgi: Fix a remote code execution vulnerability

2016-04-08 15:54:53 +01:00

qos.cgi

QoS: Improve saving enabled/disable state

2016-01-05 21:04:05 +00:00

remote.cgi

remote.cgi: htmlcleanup, change html tags from uppercase to lowercase

2014-02-15 15:48:47 +01:00

routing.cgi

BUG10993: fix errormessage when editing static routes

2015-12-10 16:37:22 +00:00

samba.cgi

samba: Make sure that permissions of the lock dir are fine.

2014-06-12 16:14:11 +02:00

sambahlp.cgi

Ein Paar Dateien fuer die GPLv3 angepasst.

2007-08-29 13:25:32 +00:00

services.cgi

BUG10797: Fix addontable in services.cgi when using squid-accounting addon

2015-04-13 08:36:00 +02:00

shutdown.cgi

shutdown.cgi: fix missing image.

2014-02-04 16:13:57 +01:00

speed.cgi

speed.cgi: Suppress error messages if not connected to the internet.

2013-09-07 16:23:50 +02:00

system.cgi

Change order of the graphs on the system CGI.

2011-02-08 21:40:36 +01:00

time.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

tor.cgi

tor.cgi: Fix missing country flag icons.

2015-10-15 15:42:44 +01:00

traffic.cgi

traffic.cgi: remove work around for a fixed vnstat(i) bug.

2014-06-07 13:55:34 +02:00

updatexlrator.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

upnp.cgi

cgi-bin: Remove font tags with no effect, and style tags

2014-02-22 12:13:02 +01:00

urlfilter.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

vpnmain.cgi

IPSec VPN: Add "required" marker for "organization name"

2015-10-15 15:44:56 +01:00

wakeonlan.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

webaccess.cgi

webaccess.cgi: Fixed language settings.

2016-01-19 00:06:30 +00:00

wireless.cgi

Mark required input fields with a star

2015-09-21 16:40:41 +01:00

wirelessclient.cgi

fifteen-theme: made wirelessclient.cgi table themeable

2014-01-08 15:03:03 +01:00

wlanap.cgi

wlansp.cgi: remove MADWIFI functions.

2015-04-11 22:18:26 +02:00