From cfa53879d62806c63b412e26fd5e53138a4a8070 Mon Sep 17 00:00:00 2001 From: Ermal Date: Mon, 24 Mar 2014 20:14:19 +0000 Subject: While here escape the passed valuye to avoid problems with input --- etc/inc/captiveportal.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'etc/inc/captiveportal.inc') diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index c3b72e4..78a70a2 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -1478,7 +1478,7 @@ function captiveportal_get_dn_passthru_ruleno($value) { if (file_exists("{$g['vardb_path']}/captiveportaldn.rules")) { $rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportaldn.rules")); unset($output); - $_gb = exec("/sbin/ipfw -x {$cpzoneid} show | /usr/bin/grep {$value} | /usr/bin/grep -v grep | /usr/bin/awk '{print $5}' | /usr/bin/head -n 1", $output); + $_gb = exec("/sbin/ipfw -x {$cpzoneid} show | /usr/bin/grep " . escapeshellarg($value) . " | /usr/bin/grep -v grep | /usr/bin/awk '{print $5}' | /usr/bin/head -n 1", $output); $ruleno = intval($output[0]); if (!$rules[$ruleno]) $ruleno = NULL; @@ -1566,7 +1566,7 @@ function captiveportal_get_ipfw_passthru_ruleno($value) { if (file_exists("{$g['vardb_path']}/captiveportal_{$cpzone}.rules")) { $rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal_{$cpzone}.rules")); unset($output); - $_gb = exec("/sbin/ipfw -x {$cpzoneid} show | /usr/bin/grep {$value} | /usr/bin/grep -v grep | /usr/bin/awk '{print $1}' | /usr/bin/head -n 1", $output); + $_gb = exec("/sbin/ipfw -x {$cpzoneid} show | /usr/bin/grep " . escapeshellarg($value) . " | /usr/bin/grep -v grep | /usr/bin/awk '{print $1}' | /usr/bin/head -n 1", $output); $ruleno = intval($output[0]); if (!$rules[$ruleno]) $ruleno = NULL; -- cgit v1.1