summaryrefslogtreecommitdiffstats
path: root/usr
diff options
context:
space:
mode:
authorRenato Botelho <garga@FreeBSD.org>2014-06-17 10:19:34 -0300
committerRenato Botelho <garga@FreeBSD.org>2014-06-17 10:19:34 -0300
commitaa27de6e78ae42d268bd4a53fd0bbe755425e561 (patch)
treece69e5186ddda93cb2f11b8ab57e8c49ef60b2a3 /usr
parent592abfa4a4f775324d194a6f8064253a0c98e6c3 (diff)
downloadpfsense-aa27de6e78ae42d268bd4a53fd0bbe755425e561.zip
pfsense-aa27de6e78ae42d268bd4a53fd0bbe755425e561.tar.gz
Make sure variables are escaped, also replace exec calls to run rm by unlink_if_exists()
Diffstat (limited to 'usr')
-rw-r--r--usr/local/www/status_rrd_graph_img.php8
1 files changed, 4 insertions, 4 deletions
diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php
index 387f09b..5772014 100644
--- a/usr/local/www/status_rrd_graph_img.php
+++ b/usr/local/www/status_rrd_graph_img.php
@@ -43,7 +43,7 @@ global $g;
$pgtitle = array(gettext("System"),gettext("RRD Graphs"),gettext("Image viewer"));
if ($_GET['database']) {
- $curdatabase = basename($_GET['database']);
+ $curdatabase = escapeshellarg(basename($_GET['database']));
} else {
$curdatabase = "wan-traffic.rrd";
}
@@ -56,7 +56,7 @@ if ($_GET['style']) {
/* this is used for temp name */
if ($_GET['graph']) {
- $curgraph = $_GET['graph'];
+ $curgraph = escapeshellarg($_GET['graph']);
} else {
$curgraph = "custom";
}
@@ -1199,14 +1199,14 @@ if(($graphcmdreturn <> 0) || (! $data)) {
log_error(sprintf(gettext('Failed to create graph with error code %1$s, the error is: %2$s'),$graphcmdreturn,$graphcmdoutput));
if(strstr($curdatabase, "queues")) {
log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
- exec("/bin/rm -f $rrddbpath$curif$queues");
+ unlink_if_exists($rrddbpath . $curif . $queues);
flush();
usleep(500);
enable_rrd_graphing();
}
if(strstr($curdatabase, "queuesdrop")) {
log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
- exec("/bin/rm -f $rrddbpath$curdatabase");
+ unlink_if_exists($rrddbpath . $curdatabase);
flush();
usleep(500);
enable_rrd_graphing();
OpenPOWER on IntegriCloud