Add input validation to check if the gateway IP is in the local subnet for that interface.

Needs testing, no idea if this works for ppp or pppoe interfaces.

1 files changed, 5 insertions, 0 deletions

diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php
index 6c192a8..c3aabb6 100755
--- a/usr/local/www/system_gateways_edit.php
+++ b/usr/local/www/system_gateways_edit.php
@@ -93,6 +93,11 @@ if ($_POST) {
 	if ($_POST['gateway'] && (!is_ipaddr($_POST['gateway'])) && ($pconfig['attribute'] != "system")) {
 		$input_errors[] = "A valid gateway IP address must be specified.";
 	}
+	if ($_POST['gateway'] && (is_ipaddr($_POST['gateway'])) && ($pconfig['attribute'] != "system")) {
+		if(! ip_in_subnet($_POST['gateway']), get_interface_subnet($interface)) {
+			$input_errors[] = "The Address {$_POST['gateway']} does not lie in the interface subnet";                
+		}
+	}
 	if ((($_POST['monitor'] <> "") && !is_ipaddr($_POST['monitor']))) {
 		$input_errors[] = "A valid monitor IP address must be specified.";
 	}