mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make scripts XSS input safe.

Browse Source 
Pointed-out: by hoopercharles@gmail.com
This commit is contained in:
Scott Ullrich 2008-02-12 04:33:24 +00:00
parent 6c13d55182
commit b5aebbf5d1
6 changed files with 28 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
usr/local/www/pkg.php
View File

@ -39,7 +39,7 @@ function gentitle_pkg($pgname) {
return $config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pgname;
}
$xml = $_GET['xml'];
$xml = htmlspecialchars($_GET['xml']);
if($xml == "") {
print_info_box_np(gettext("ERROR: No package defined."));
@ -108,7 +108,7 @@ include("fbegin.inc");
?>
<p class="pgtitle"><?=$pgtitle?></p>
<form action="pkg.php" method="post">
<? if($_GET['savemsg'] <> "") $savemsg = $_GET['savemsg']; ?>
<? if($_GET['savemsg'] <> "") $savemsg = htmlspecialchars($_GET['savemsg']); ?>
<?php if ($savemsg) print_info_box($savemsg); ?>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<?php

11
usr/local/www/pkg_edit.php
View File

@ -39,9 +39,8 @@ function gentitle_pkg($pgname) {
return $pfSense_config['system']['hostname'] . "." . $pfSense_config['system']['domain'] . " - " . $pgname;
}
// XXX: Make this input safe.
$xml = $_GET['xml'];
if($_POST['xml']) $xml = $_POST['xml'];
$xml = htmlspecialchars($_GET['xml']);
if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']);
if($xml == "") {
print_info_box_np(gettext("ERROR: No package defined."));
@ -66,9 +65,9 @@ $name = $pkg['name'];
$title = $pkg['title'];
$pgtitle = $title;
$id = $_GET['id'];
$id = htmlspecialchars($_GET['id']);
if (isset($_POST['id']))
$id = $_POST['id'];
$id = htmlspecialchars($_POST['id']);
if($pkg['custom_php_global_functions'] <> "")
eval($pkg['custom_php_global_functions']);
@ -80,7 +79,7 @@ if(!is_array($config['installedpackages'][xml_safe_fieldname($pkg['name'])]['con
$a_pkg = &$config['installedpackages'][xml_safe_fieldname($pkg['name'])]['config'];
if($_GET['savemsg'] <> "")
$savemsg = $_GET['savemsg'];
$savemsg = htmlspecialchars($_GET['savemsg']);
if($pkg['custom_php_command_before_form'] <> "")
eval($pkg['custom_php_command_before_form']);

2
usr/local/www/pkg_mgr.php
View File

@ -48,7 +48,7 @@ if($pkg_info) {
if (! empty($_GET)) {
if (isset($_GET['ver'])) {
$requested_version = $_GET['ver'];
$requested_version = htmlspecialchars($_GET['ver']);
}
}

30
usr/local/www/pkg_mgr_install.php
View File

@ -117,30 +117,30 @@ sync_webgui_passwords();
switch($_GET['mode']) {
case "delete":
$id = get_pkg_id($_GET['pkg']);
$id = get_pkg_id(htmlspecialchars($_GET['pkg']));
$todel = substr(reverse_strrchr($config['installedpackages']['package'][$id]['depends_on_package'], "."), 0, -1);
delete_package($todel, $_GET['pkg']);
delete_package_xml($_GET['pkg']);
delete_package($todel, htmlspecialchars($_GET['pkg']));
delete_package_xml(htmlspecialchars($_GET['pkg']));
update_status("Package deleted.");
$static_output .= "\nPackage deleted.";
update_output_window($static_output);
break;
case "reinstallpkg":
$id = get_pkg_id($_GET['pkg']);
$id = get_pkg_id(htmlspecialchars($_GET['pkg']));
$todel = substr(reverse_strrchr($config['installedpackages']['package'][$id]['depends_on_package'], "."), 0, -1);
delete_package($todel, $_GET['pkg']);
delete_package_xml($_GET['pkg']);
install_package($_GET['pkg']);
delete_package($todel, htmlspecialchars($_GET['pkg']));
delete_package_xml(htmlspecialchars($_GET['pkg']));
install_package(htmlspecialchars($_GET['pkg']));
update_status("Package reinstalled.");
$static_output .= "\n\nPackage reinstalled.";
start_service($_GET['pkg']);
start_service(htmlspecialchars($_GET['pkg']));
update_output_window($static_output);
break;
case "reinstallxml":
delete_package_xml($_GET['pkg']);
install_package($_GET['pkg']);
delete_package_xml(htmlspecialchars($_GET['pkg']));
install_package(htmlspecialchars($_GET['pkg']));
$static_output .= "\n\nPackage reinstalled.";
start_service($_GET['pkg']);
start_service(htmlspecialchars($_GET['pkg']));
update_output_window($static_output);
break;
case "reinstallall":
@ -158,16 +158,16 @@ switch($_GET['mode']) {
}
update_status("All packages reinstalled.");
$static_output .= "\n\nAll packages reinstalled.";
start_service($_GET['pkg']);
start_service(htmlspecialchars($_GET['pkg']));
update_output_window($static_output);
break;
default:
$status = install_package($_GET['id']);
$status = install_package(htmlspecialchars($_GET['id']));
if($status == -1) {
update_status("Installation of {$_GET['id']} FAILED!");
update_status("Installation of " . htmlspecialchars($_GET['id']) . " FAILED!");
$static_output .= "\n\nInstallation halted.";
} else {
update_status("Installation of {$_GET['id']} completed.");
update_status("Installation of " . $_GET['id'] ." completed.");
$static_output .= "\n\nInstallation completed. Please check to make sure that the package is configured from the respective menu then start the package.";
}
update_output_window($static_output);

5
usr/local/www/services_dhcp_edit.php
View File

@ -109,11 +109,6 @@ if ($_POST) {
$dynsubnet_end = ip2long($config['dhcpd'][$if]['range']['to']);
$lansubnet_start = (ip2long($ifcfg['ipaddr']) & gen_subnet_mask_long($ifcfg['subnet']));
$lansubnet_end = (ip2long($ifcfg['ipaddr']) | (~gen_subnet_mask_long($ifcfg['subnet'])));
if ((ip2long($_POST['ipaddr']) >= $dynsubnet_start) &&
(ip2long($_POST['ipaddr']) <= $dynsubnet_end)) {
$input_errors[] = "Static IP address falls within the dynamic client range.";
}
if ((ip2long($_POST['ipaddr']) < $lansubnet_start) ||
(ip2long($_POST['ipaddr']) > $lansubnet_end)) {
$input_errors[] = "The IP address must lie in the {$ifcfg['descr']} subnet.";

11
usr/local/www/wizard.php
View File

@ -36,12 +36,11 @@ function gentitle_pkg($pgname) {
$stepid = $_GET['stepid'];
if (isset($_POST['stepid']))
$stepid = $_POST['stepid'];
$stepid = htmlspecialchars($_POST['stepid']);
if (!$stepid) $stepid = "0";
// XXX: Make this input safe.
$xml = $_GET['xml'];
if($_POST['xml']) $xml = $_POST['xml'];
$xml = htmlspecialchars($_GET['xml']);
if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']);
if($xml == "") {
$xml = "not_defined";
@ -232,9 +231,9 @@ function enablechange() {
<tr><td colspan='2'>
<?php
if ($_GET['message'] != "")
print_info_box($_GET['message']);
print_info_box(htmlspecialchars($_GET['message']));
if ($_POST['message'] != "")
print_info_box($_POST['message']);
print_info_box(htmlspecialchars($_POST['message']));
?></td></tr>
<tr><td colspan='2'><center><b><?= fixup_string($description) ?></b></center></td></tr><tr><td>&nbsp;</td></tr>
<?php