From 8bc944bbcba57f74934b87dcea4e7621f0743584 Mon Sep 17 00:00:00 2001 From: jim-p Date: Thu, 5 Sep 2019 12:31:50 -0400 Subject: [PATCH] status.php: Sanitize influx_pass and cert_key. Fixes #9727 Fixes #9728 --- src/usr/local/www/status.php | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/src/usr/local/www/status.php b/src/usr/local/www/status.php index be144da9ee..fdb7be1076 100644 --- a/src/usr/local/www/status.php +++ b/src/usr/local/www/status.php @@ -63,16 +63,17 @@ $output_file = "/tmp/status_output.tgz"; $filtered_tags = array( 'accountkey', 'authorizedkeys', 'auth_pass', 'auth_user', 'bcrypt-hash', - 'crypto_password', 'crypto_password2', 'dns_nsupdatensupdate_key', - 'encryption_password', 'gold_encryption_password', 'gold_password', - 'ipsecpsk', 'ldap_bindpw', 'lighttpd_ls_password', - 'lighttpd_ls_password', 'md5-hash', 'md5password', 'md5sigkey', - 'md5sigpass', 'nt-hash', 'passphrase', 'password', 'passwordagain', - 'pre-shared-key', 'proxypass', 'proxy_passwd', 'proxyuser', - 'proxy_user', 'prv', 'radius_secret', 'redis_password', - 'redis_passwordagain', 'rocommunity', 'secret', 'shared_key', 'tls', - 'varclientpasswordinput', 'varclientsharedsecret', 'varsyncpassword', - 'varusersmotpinitsecret', 'varusersmotppin' + 'cert_key', 'crypto_password', 'crypto_password2', + 'dns_nsupdatensupdate_key', 'encryption_password', + 'gold_encryption_password', 'gold_password', 'influx_pass', 'ipsecpsk', + 'ldap_bindpw', 'lighttpd_ls_password', 'lighttpd_ls_password', + 'md5-hash', 'md5password', 'md5sigkey', 'md5sigpass', 'nt-hash', + 'passphrase', 'password', 'passwordagain', 'pre-shared-key', + 'proxypass', 'proxy_passwd', 'proxyuser', 'proxy_user', 'prv', + 'radius_secret', 'redis_password', 'redis_passwordagain', 'rocommunity', + 'secret', 'shared_key', 'tls', 'varclientpasswordinput', + 'varclientsharedsecret', 'varsyncpassword', 'varusersmotpinitsecret', + 'varusersmotppin' ); if ($_POST['submit'] == "DOWNLOAD" && file_exists($output_file)) {