diff options
| author | jim-p <jimp@pfsense.org> | 2016-06-09 09:25:42 -0400 |
|---|---|---|
| committer | jim-p <jimp@pfsense.org> | 2016-06-09 09:26:14 -0400 |
| commit | 2095e91fa7985da8f86df4a9e6d8f58cc1088487 (patch) | |
| tree | a5dc53fe281c5ed2b1c6969a5f231246ac3bf500 | |
| parent | 00ad639081312a8e125f4fe35812ebb7ca258d75 (diff) | |
| download | pfsense-2095e91fa7985da8f86df4a9e6d8f58cc1088487.zip pfsense-2095e91fa7985da8f86df4a9e6d8f58cc1088487.tar.gz | |
Add input validation to system_groupmanager.php to prevent invalid members from being submitted. Ticket #6475
| -rw-r--r-- | src/usr/local/www/system_groupmanager.php | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/usr/local/www/system_groupmanager.php b/src/usr/local/www/system_groupmanager.php index fb17f76..9510084 100644 --- a/src/usr/local/www/system_groupmanager.php +++ b/src/usr/local/www/system_groupmanager.php @@ -188,11 +188,17 @@ if (isset($_POST['save'])) { } } - if (strlen($_POST['groupname']) > 16) { $input_errors[] = gettext("The group name is longer than 16 characters."); } + /* Check the POSTed members to ensure they are valid and exist */ + foreach ($_POST['members'] as $newmember) { + if (!is_numeric($newmember) || empty(getUserEntryByUID($newmember))) { + $input_errors[] = gettext("One or more invalid group members was submitted."); + } + } + if (!$input_errors && !(isset($id) && $a_group[$id])) { /* make sure there are no dupes */ foreach ($a_group as $group) { |
