frodovdr
/
raspap-webgui
mirror of https://github.com/billz/raspap-webgui.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #1303 from RaspAP/fix/sanitize-input 

Sanitize post data w/ escapeshellcmd()
This commit is contained in:
Bill Zimmerman 2023-02-18 08:33:53 +01:00 committed by GitHub
parent d19249757e 1fabc48169
commit f969236d93
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ajax/logging/clearlog.php
View File

@ -5,7 +5,7 @@ require_once '../../includes/config.php';
require_once '../../includes/functions.php';
if (isset($_POST['logfile'])) {
$logfile = $_POST['logfile'];
$logfile = escapeshellcmd($_POST['logfile']);
// truncate requested log file
exec("sudo truncate -s 0 $logfile", $return);

2
ajax/openvpn/activate_ovpncfg.php
View File

@ -5,7 +5,7 @@ require_once '../../includes/config.php';
require_once '../../includes/functions.php';
if (isset($_POST['cfg_id'])) {
$ovpncfg_id = $_POST['cfg_id'];
$ovpncfg_id = escapeshellcmd($_POST['cfg_id']);
$ovpncfg_client = RASPI_OPENVPN_CLIENT_PATH.$ovpncfg_id.'_client.conf';
$ovpncfg_login = RASPI_OPENVPN_CLIENT_PATH.$ovpncfg_id.'_login.conf';

2
ajax/openvpn/del_ovpncfg.php
View File

@ -5,7 +5,7 @@ require_once '../../includes/config.php';
require_once '../../includes/functions.php';
if (isset($_POST['cfg_id'])) {
$ovpncfg_id = $_POST['cfg_id'];
$ovpncfg_id = escapeshellcmd($_POST['cfg_id']);
$ovpncfg_files = pathinfo(RASPI_OPENVPN_CLIENT_LOGIN, PATHINFO_DIRNAME).'/'.$ovpncfg_id.'_*.conf';
exec("sudo rm $ovpncfg_files", $return);
$jsonData = ['return'=>$return];