diff options
| author | jim-p <jimp@netgate.com> | 2019-01-29 10:47:45 -0500 |
|---|---|---|
| committer | jim-p <jimp@netgate.com> | 2019-01-29 14:23:04 -0500 |
| commit | 10b06be56c6860f5ac7b890d58c0c3cca8639c63 (patch) | |
| tree | ea0b833ddf9d358cd9c49c4b60335672c2b9bb0c /src/usr/local/www | |
| parent | 140655f7392a4df1601a9c4473c517bf10173968 (diff) | |
| download | pfsense-10b06be56c6860f5ac7b890d58c0c3cca8639c63.zip pfsense-10b06be56c6860f5ac7b890d58c0c3cca8639c63.tar.gz | |
Fix input validation of webguiproto. Issue #9294
(cherry picked from commit 56888f24ca2715e678a1324633a08d3a611b4136)
Diffstat (limited to 'src/usr/local/www')
| -rw-r--r-- | src/usr/local/www/system_advanced_admin.php | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/usr/local/www/system_advanced_admin.php b/src/usr/local/www/system_advanced_admin.php index 1ecbef4..e6bcd6f 100644 --- a/src/usr/local/www/system_advanced_admin.php +++ b/src/usr/local/www/system_advanced_admin.php @@ -39,6 +39,8 @@ require_once("shaper.inc"); init_config_arr(array('system', 'webgui')); init_config_arr(array('system', 'ssh')); +$valid_webguiproto = array('http', 'https'); + $pconfig['webguiproto'] = $config['system']['webgui']['protocol']; $pconfig['webguiport'] = $config['system']['webgui']['port']; $pconfig['max_procs'] = ($config['system']['webgui']['max_procs']) ? $config['system']['webgui']['max_procs'] : 2; @@ -86,6 +88,11 @@ if ($_POST) { $pconfig = $_POST; /* input validation */ + + if (!in_array($pconfig['webguiproto'], $valid_webguiproto)) { + $input_errors[] = gettext("A valid webConfigurator protocol must be specified"); + } + if ($_POST['webguiport']) { if (!is_port($_POST['webguiport'])) { $input_errors[] = gettext("A valid webConfigurator port number must be specified"); @@ -315,7 +322,7 @@ if ($_POST) { } else { list($host) = explode(":", $_SERVER['HTTP_HOST']); } - $prot = $config['system']['webgui']['protocol']; + $prot = in_array($config['system']['webgui']['protocol'], $valid_webguiproto) ? $config['system']['webgui']['protocol'] : 'http' ; $port = $config['system']['webgui']['port']; if ($port) { $url = "{$prot}://{$host}:{$port}/system_advanced_admin.php"; |
