diff --git a/ajax/networking/get_int_config.php b/ajax/networking/get_int_config.php index 5e1c9b86..d29ee735 100644 --- a/ajax/networking/get_int_config.php +++ b/ajax/networking/get_int_config.php @@ -5,8 +5,7 @@ include_once('../../includes/functions.php'); if(isset($_POST['interface']) && isset($_POST['csrf_token']) && CSRFValidate()) { - $int = $_POST['interface']; - // FIXME slashes and other forbidden filename characters not stripped. [security] + $int = preg_replace('/[^a-z0-9]/', '', $_POST['interface']); if(!file_exists(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini')) { touch(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini'); }