mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add some protection to parameters that come through _GET

Browse Source
This commit is contained in:
Renato Botelho 2014-06-06 11:48:15 -03:00
parent cbf16c3020
commit 4cc342453c
2 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
etc/inc/service-utils.inc
View File

@ -515,7 +515,7 @@ function service_control_start($name, $extras) {
services_radvd_configure();
break;
case 'captiveportal':
$zone = $extras['zone'];
$zone = htmlspecialchars($extras['zone']);
captiveportal_init_webgui_zonename($zone);
break;
case 'ntpd':
@ -550,9 +550,9 @@ function service_control_start($name, $extras) {
vpn_ipsec_force_reload();
break;
case 'openvpn':
$vpnmode = isset($extras['vpnmode']) ? $extras['vpnmode'] : $extras['mode'];
$vpnmode = isset($extras['vpnmode']) ? htmlspecialchars($extras['vpnmode']) : htmlspecialchars($extras['mode']);
if (($vpnmode == "server") || ($vpnmode == "client")) {
$id = isset($extras['vpnid']) ? $extras['vpnid'] : $extras['id'];
$id = isset($extras['vpnid']) ? htmlspecialchars($extras['vpnid']) : htmlspecialchars($extras['id']);
$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
if (file_exists($configfile))
openvpn_restart_by_vpnid($vpnmode, $id);
@ -574,7 +574,7 @@ function service_control_stop($name, $extras) {
killbypid("{$g['varrun_path']}/radvd.pid");
break;
case 'captiveportal':
$zone = $extras['zone'];
$zone = htmlspecialchars($extras['zone']);
killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
break;
@ -618,9 +618,9 @@ function service_control_stop($name, $extras) {
exec("killall -9 racoon");
break;
case 'openvpn':
$vpnmode = $extras['vpnmode'];
$vpnmode = htmlspecialchars($extras['vpnmode']);
if (($vpnmode == "server") or ($vpnmode == "client")) {
$id = $extras['id'];
$id = htmlspecialchars($extras['id']);
$pidfile = "{$g['varrun_path']}/openvpn_{$vpnmode}{$id}.pid";
killbypid($pidfile);
}
@ -641,7 +641,7 @@ function service_control_restart($name, $extras) {
services_radvd_configure();
break;
case 'captiveportal':
$zone = $extras['zone'];
$zone = htmlspecialchars($extras['zone']);
killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
captiveportal_init_webgui_zonename($zone);
@ -679,9 +679,9 @@ function service_control_restart($name, $extras) {
vpn_ipsec_force_reload();
break;
case 'openvpn':
$vpnmode = $extras['vpnmode'];
$vpnmode = htmlspecialchars($extras['vpnmode']);
if ($vpnmode == "server" || $vpnmode == "client") {
$id = $extras['id'];
$id = htmlspecialchars($extras['id']);
$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
if (file_exists($configfile))
openvpn_restart_by_vpnid($vpnmode, $id);

12
usr/local/www/status_services.php
View File

@ -41,16 +41,20 @@ require_once("guiconfig.inc");
require_once("service-utils.inc");
require_once("shortcuts.inc");
if (!empty($_GET['service'])) {
$service_name = '';
if (isset($_GET['service']))
$service_name = htmlspecialchars($_GET['service']);
if (!empty($service_name)) {
switch ($_GET['mode']) {
case "restartservice":
$savemsg = service_control_restart($_GET['service'], $_GET);
$savemsg = service_control_restart($service_name, $_GET);
break;
case "startservice":
$savemsg = service_control_start($_GET['service'], $_GET);
$savemsg = service_control_start($service_name, $_GET);
break;
case "stopservice":
$savemsg = service_control_stop($_GET['service'], $_GET);
$savemsg = service_control_stop($service_name, $_GET);
break;
}
sleep(5);