From b5aebbf5d1459c429b60fabac0c726a04700bdca Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Tue, 12 Feb 2008 04:33:24 +0000 Subject: [PATCH] Make scripts XSS input safe. Pointed-out: by hoopercharles@gmail.com --- usr/local/www/pkg.php | 4 ++-- usr/local/www/pkg_edit.php | 11 +++++----- usr/local/www/pkg_mgr.php | 2 +- usr/local/www/pkg_mgr_install.php | 30 ++++++++++++++-------------- usr/local/www/services_dhcp_edit.php | 5 ----- usr/local/www/wizard.php | 11 +++++----- 6 files changed, 28 insertions(+), 35 deletions(-) diff --git a/usr/local/www/pkg.php b/usr/local/www/pkg.php index 7a48c20d9e..602daf3fdf 100755 --- a/usr/local/www/pkg.php +++ b/usr/local/www/pkg.php @@ -39,7 +39,7 @@ function gentitle_pkg($pgname) { return $config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pgname; } -$xml = $_GET['xml']; +$xml = htmlspecialchars($_GET['xml']); if($xml == "") { print_info_box_np(gettext("ERROR: No package defined.")); @@ -108,7 +108,7 @@ include("fbegin.inc"); ?>

- "") $savemsg = $_GET['savemsg']; ?> + "") $savemsg = htmlspecialchars($_GET['savemsg']); ?> "") eval($pkg['custom_php_global_functions']); @@ -80,7 +79,7 @@ if(!is_array($config['installedpackages'][xml_safe_fieldname($pkg['name'])]['con $a_pkg = &$config['installedpackages'][xml_safe_fieldname($pkg['name'])]['config']; if($_GET['savemsg'] <> "") - $savemsg = $_GET['savemsg']; + $savemsg = htmlspecialchars($_GET['savemsg']); if($pkg['custom_php_command_before_form'] <> "") eval($pkg['custom_php_command_before_form']); diff --git a/usr/local/www/pkg_mgr.php b/usr/local/www/pkg_mgr.php index f9968ef4c5..f6c9f0f660 100755 --- a/usr/local/www/pkg_mgr.php +++ b/usr/local/www/pkg_mgr.php @@ -48,7 +48,7 @@ if($pkg_info) { if (! empty($_GET)) { if (isset($_GET['ver'])) { - $requested_version = $_GET['ver']; + $requested_version = htmlspecialchars($_GET['ver']); } } diff --git a/usr/local/www/pkg_mgr_install.php b/usr/local/www/pkg_mgr_install.php index 4a7350f450..07c28ff3ed 100755 --- a/usr/local/www/pkg_mgr_install.php +++ b/usr/local/www/pkg_mgr_install.php @@ -117,30 +117,30 @@ sync_webgui_passwords(); switch($_GET['mode']) { case "delete": - $id = get_pkg_id($_GET['pkg']); + $id = get_pkg_id(htmlspecialchars($_GET['pkg'])); $todel = substr(reverse_strrchr($config['installedpackages']['package'][$id]['depends_on_package'], "."), 0, -1); - delete_package($todel, $_GET['pkg']); - delete_package_xml($_GET['pkg']); + delete_package($todel, htmlspecialchars($_GET['pkg'])); + delete_package_xml(htmlspecialchars($_GET['pkg'])); update_status("Package deleted."); $static_output .= "\nPackage deleted."; update_output_window($static_output); break; case "reinstallpkg": - $id = get_pkg_id($_GET['pkg']); + $id = get_pkg_id(htmlspecialchars($_GET['pkg'])); $todel = substr(reverse_strrchr($config['installedpackages']['package'][$id]['depends_on_package'], "."), 0, -1); - delete_package($todel, $_GET['pkg']); - delete_package_xml($_GET['pkg']); - install_package($_GET['pkg']); + delete_package($todel, htmlspecialchars($_GET['pkg'])); + delete_package_xml(htmlspecialchars($_GET['pkg'])); + install_package(htmlspecialchars($_GET['pkg'])); update_status("Package reinstalled."); $static_output .= "\n\nPackage reinstalled."; - start_service($_GET['pkg']); + start_service(htmlspecialchars($_GET['pkg'])); update_output_window($static_output); break; case "reinstallxml": - delete_package_xml($_GET['pkg']); - install_package($_GET['pkg']); + delete_package_xml(htmlspecialchars($_GET['pkg'])); + install_package(htmlspecialchars($_GET['pkg'])); $static_output .= "\n\nPackage reinstalled."; - start_service($_GET['pkg']); + start_service(htmlspecialchars($_GET['pkg'])); update_output_window($static_output); break; case "reinstallall": @@ -158,16 +158,16 @@ switch($_GET['mode']) { } update_status("All packages reinstalled."); $static_output .= "\n\nAll packages reinstalled."; - start_service($_GET['pkg']); + start_service(htmlspecialchars($_GET['pkg'])); update_output_window($static_output); break; default: - $status = install_package($_GET['id']); + $status = install_package(htmlspecialchars($_GET['id'])); if($status == -1) { - update_status("Installation of {$_GET['id']} FAILED!"); + update_status("Installation of " . htmlspecialchars($_GET['id']) . " FAILED!"); $static_output .= "\n\nInstallation halted."; } else { - update_status("Installation of {$_GET['id']} completed."); + update_status("Installation of " . $_GET['id'] ." completed."); $static_output .= "\n\nInstallation completed. Please check to make sure that the package is configured from the respective menu then start the package."; } update_output_window($static_output); diff --git a/usr/local/www/services_dhcp_edit.php b/usr/local/www/services_dhcp_edit.php index d8d83c7605..1948e7ecf4 100755 --- a/usr/local/www/services_dhcp_edit.php +++ b/usr/local/www/services_dhcp_edit.php @@ -109,11 +109,6 @@ if ($_POST) { $dynsubnet_end = ip2long($config['dhcpd'][$if]['range']['to']); $lansubnet_start = (ip2long($ifcfg['ipaddr']) & gen_subnet_mask_long($ifcfg['subnet'])); $lansubnet_end = (ip2long($ifcfg['ipaddr']) | (~gen_subnet_mask_long($ifcfg['subnet']))); - - if ((ip2long($_POST['ipaddr']) >= $dynsubnet_start) && - (ip2long($_POST['ipaddr']) <= $dynsubnet_end)) { - $input_errors[] = "Static IP address falls within the dynamic client range."; - } if ((ip2long($_POST['ipaddr']) < $lansubnet_start) || (ip2long($_POST['ipaddr']) > $lansubnet_end)) { $input_errors[] = "The IP address must lie in the {$ifcfg['descr']} subnet."; diff --git a/usr/local/www/wizard.php b/usr/local/www/wizard.php index a0c324e4cf..3822a63d33 100755 --- a/usr/local/www/wizard.php +++ b/usr/local/www/wizard.php @@ -36,12 +36,11 @@ function gentitle_pkg($pgname) { $stepid = $_GET['stepid']; if (isset($_POST['stepid'])) - $stepid = $_POST['stepid']; + $stepid = htmlspecialchars($_POST['stepid']); if (!$stepid) $stepid = "0"; -// XXX: Make this input safe. -$xml = $_GET['xml']; -if($_POST['xml']) $xml = $_POST['xml']; +$xml = htmlspecialchars($_GET['xml']); +if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']); if($xml == "") { $xml = "not_defined"; @@ -232,9 +231,9 @@ function enablechange() {