Renato Botelho
902da38805
Remove also . and / from graph
2014-06-19 13:04:57 -03:00
Renato Botelho
bc27c6d1ee
Remove more backticks
2014-06-19 12:29:34 -03:00
Renato Botelho
57627d9f31
Fix status_rrd_graph_img.php and also improve it:
...
- Remove escapeshellarg that broke command line
- Only remove dangerous chars to avoid command injection
- Replace all `hostname` calls by php_uname('n')
- Replace all `date` calls by strftime()
- Add $_gb to collect possibly garbage from exec return
2014-06-19 12:26:57 -03:00
Renato Botelho
bef1056048
Make sure single quotes are encoded and avoid javascript injection
2014-06-19 11:30:38 -03:00
Renato Botelho
daeab6c453
Fix indent and whitespaces
2014-06-19 11:29:40 -03:00
Renato Botelho
aba02f6560
Simplify logic, add some protection to user input parameters
2014-06-18 16:54:05 -03:00
Renato Botelho
f334f8bf3d
Fix whitespaces and indent
2014-06-18 15:38:50 -03:00
Renato Botelho
bef9f697b5
We need to allow subdirectories under /usr/local/pkg, here is the proper fix
2014-06-18 13:46:23 -03:00
Renato Botelho
08f3032034
Change the option for webconfig login autocomplete from opt-in to opt-out, also bump config version and write a function to keep the current status on upgrades
2014-06-18 08:21:27 -03:00
jim-p
56bd203593
Fix syntax error
2014-06-17 21:37:17 -04:00
Renato Botelho
2b641a08ab
Protect servicestatusfilter parameter with htmlspecialchars()
2014-06-17 15:13:51 -03:00
Renato Botelho
e4921058c6
Protect rssfeed parameters with htmlspecialchars()
2014-06-17 14:53:58 -03:00
Renato Botelho
5de32d520b
Avoid directory traversal on restorefullbackup
2014-06-17 13:47:29 -03:00
Matt Smith
b67cdd05ab
Fix core dump on viewing invalid package log
2014-06-17 11:37:26 -05:00
Renato Botelho
7145cd87d1
Remove . and / from pkg name to avoid directory traversal
2014-06-17 11:17:23 -03:00
Renato Botelho
c3936caf80
Remove id=0 from miniupnpd menu and shortcut
2014-06-17 10:48:31 -03:00
Renato Botelho
69eb2e295f
Avoid directory traversal when reading package xml files, also check if file exists before try to read it
2014-06-17 10:33:18 -03:00
Renato Botelho
d09ff9ef32
Make sure variables are escaped, also replace exec calls to run rm by unlink_if_exists()
2014-06-17 10:19:54 -03:00
Renato Botelho
65eb0f61a4
Remove useless code, variable is set again on next line
2014-06-17 10:19:52 -03:00
Renato Botelho
45438fd3fd
Escape parameters passed to shell_exec()
2014-06-17 09:40:27 -03:00
Renato Botelho
76c4ff0ecf
Be more careful with host parameter and make sure it's escaped when call shell functions
2014-06-17 09:31:37 -03:00
Renato Botelho
65f815dd9f
Validate starttime and stoptime format
2014-06-17 07:33:46 -03:00
jim-p
ef462f2580
Make the byte counts on OpenVPN status human readable rather than huge unformatted numbers.
2014-06-16 14:00:00 -04:00
Renato Botelho
6f3d20631d
Replace Header() calls by lowercase
2014-06-13 08:59:57 -03:00
Renato Botelho
bcfd894ebd
Merge pull request #1229 from ExolonDX/branch-master_06
2014-06-13 08:36:52 -03:00
Renato Botelho
718af29d29
Merge pull request #1228 from ExolonDX/branch_master_05
2014-06-13 08:36:47 -03:00
Ermal
cbe38717c6
Bring the code of captiveportal up to speed with its module counterpart requirments
2014-06-12 21:06:10 +00:00
Renato Botelho
859a530456
Fix #3665 , show IPSec tunnel description on status page
2014-06-12 08:59:12 -03:00
Renato Botelho
bd75704311
Fix a typo on variable name
2014-06-12 08:33:41 -03:00
Renato Botelho
6186c00a11
Fix td class
2014-06-12 08:16:29 -03:00
Chris Buechler
daa169f756
remove extra .
2014-06-11 00:23:31 -05:00
Renato Botelho
f2c8603164
Be more precise to match members of a bridge interface, it should fix #3637
2014-06-10 14:20:57 -03:00
Renato Botelho
6a0f34b86b
Do not allow interface group name to be bigger than 15 chars, helps ticket #3208
2014-06-09 15:32:08 -03:00
Renato Botelho
2f9951fe0e
Add some protection to parameters that come through _GET
2014-06-06 11:48:15 -03:00
Colin Fleming
5689813244
Tidy up misc. widgets XHTML
...
captive_portal_status.widget.php
Remove NAME from TABLE tag, not valid in XHTML
carp_status.widget.php
Add missing closing TD tag
dyn_dns_status.widget.php and
installed_packages.widgete.php
Update TD class to single line
load_balancer_status.widget.php
Add quotes to missing TD background colour
traffic_graphs.widget.php
Tidy up HTML Boolean operator
Make NAME and ID in INPUT tag unique
wake_on_lan.widget.php
Remove B tag from "widgetsubheader", alread in CSS
Center message across all columns within table
2014-06-05 22:44:55 +01:00
Colin Fleming
2690afba23
Update "pkg_edit.,php"
...
"custom_php_after_head_command", if the PHP code also contains
JavaScript ("squid_auth.xml" for example) then this will cause HTML
errors, as you are not supposed to have anything between the closing
HEAD tag and the opening BODY tag.
Add the CLOSEHEAD PHP variable, move the include HEAD.INC into the PHP
IF statement and manually close the HEAD tab, else just include HEAD.INC
2014-06-05 19:41:50 +01:00
jim-p
88e545b435
Whitespace fixes
2014-06-04 15:25:33 -04:00
jim-p
2da48592df
Allow the user to select "None" for OpenVPN client certificate, so long as they supply and auth user/pass. Ticket #3633
2014-06-04 15:22:09 -04:00
jim-p
df13b0771b
Just use ID here instead.
2014-06-04 14:17:37 -04:00
jim-p
5344099abc
Various fixes to diag_dump_states.php (Add interface column, some extra validation safety, etc). Should fix #2121
2014-06-04 14:13:23 -04:00
Renato Botelho
29732bc3cf
Update csrf-magic to 1.0.4
2014-06-03 14:39:56 -03:00
Renato Botelho
ee7f5e7abe
Merge pull request #1226 from ExolonDX/branch_master_04
2014-06-03 09:33:41 -03:00
Renato Botelho
f133039195
Merge pull request #1225 from ExolonDX/branch_master_03
2014-06-03 09:33:34 -03:00
Renato Botelho
ccc3b027cd
Merge pull request #1224 from ExolonDX/branch_master_02
2014-06-03 09:33:24 -03:00
Colin Fleming
580a6561e1
Tidy up "status_queues.php" XHTML
...
Add closing BODY and closing HTML tags if "traffic shaping is not
configured."
2014-06-03 13:12:39 +01:00
Colin Fleming
2a351d3235
Tidy up "status_openvpn.php" XHTML
...
Move the closing FORM tag after the PHP check if there are any OpenVPN
instances.
2014-06-03 13:08:30 +01:00
Colin Fleming
e6f98d5b74
Tidy up "diag_dns.php" XHTML
...
Move the "=" sign into the first table cell, this allows the output to
line up in the second cell,
Tidy up the table from the "resolution time" output.
2014-06-03 12:52:15 +01:00
Colin Fleming
26509223bc
Tidy up "crash_reporter.php" XHTML
...
Tidy up Paragraph tags
Close INPUT tags
2014-06-03 12:28:17 +01:00
Renato Botelho
0db055f097
Merge pull request #1219 from nagyrobi/patch-13
2014-06-02 08:27:22 -03:00
jim-p
0bb15b9964
Fix filename
2014-05-31 10:40:56 -04:00
