frodovdr/raspap-webgui
1
0
Fork 0
mirror of https://github.com/billz/raspap-webgui.git synced 2023-10-10 13:37:24 +02:00
Code Issues Releases Wiki Activity

Don't allow to read ini file everywhere on filesystem.

Browse Source 
Signed-off-by: D9ping <D9ping@users.noreply.github.com>
This commit is contained in:
D9ping 2018-08-06 15:02:57 +02:00
parent fb7ba20055
commit 182a6509e9
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ajax/networking/get_int_config.php
View File

@ -5,8 +5,7 @@ include_once('../../includes/functions.php');
if(isset($_POST['interface']) && isset($_POST['csrf_token']) && CSRFValidate()) { if(isset($_POST['interface']) && isset($_POST['csrf_token']) && CSRFValidate()) {
$int = $_POST['interface']; $int = preg_replace('/[^a-z0-9]/', '', $_POST['interface']);
// FIXME slashes and other forbidden filename characters not stripped. [security]
if(!file_exists(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini')) { if(!file_exists(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini')) {
touch(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini'); touch(RASPI_CONFIG_NETWORKING.'/'.$int.'.ini');
} }