From d09ff9ef322608ea8c496121faccd3d778e71e25 Mon Sep 17 00:00:00 2001
From: Renato Botelho <garga@FreeBSD.org>
Date: Tue, 17 Jun 2014 10:19:34 -0300
Subject: Make sure variables are escaped, also replace exec calls to run rm by
 unlink_if_exists()

---
 usr/local/www/status_rrd_graph_img.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'usr/local')

diff --git a/usr/local/www/status_rrd_graph_img.php b/usr/local/www/status_rrd_graph_img.php
index 321e6ab..1f0edc5 100644
--- a/usr/local/www/status_rrd_graph_img.php
+++ b/usr/local/www/status_rrd_graph_img.php
@@ -43,7 +43,7 @@ global $g;
 $pgtitle = array(gettext("System"),gettext("RRD Graphs"),gettext("Image viewer"));
 
 if ($_GET['database']) {
-	$curdatabase = basename($_GET['database']);
+	$curdatabase = escapeshellarg(basename($_GET['database']));
 } else {
 	$curdatabase = "wan-traffic.rrd";
 }
@@ -56,7 +56,7 @@ if ($_GET['style']) {
 
 /* this is used for temp name */
 if ($_GET['graph']) {
-	$curgraph = $_GET['graph'];
+	$curgraph = escapeshellarg($_GET['graph']);
 } else {
 	$curgraph = "custom";
 }
@@ -1246,14 +1246,14 @@ if(($graphcmdreturn <> 0) || (! $data)) {
 	log_error(sprintf(gettext('Failed to create graph with error code %1$s, the error is: %2$s'),$graphcmdreturn,$graphcmdoutput));
 	if(strstr($curdatabase, "queues")) {
 		log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
-		exec("/bin/rm -f $rrddbpath$curif$queues");
+		unlink_if_exists($rrddbpath . $curif . $queues);
 		flush();
 		usleep(500);
 		enable_rrd_graphing();
 	}
 	if(strstr($curdatabase, "queuesdrop")) {
 		log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
-		exec("/bin/rm -f $rrddbpath$curdatabase");
+		unlink_if_exists($rrddbpath . $curdatabase);
 		flush();
 		usleep(500);
 		enable_rrd_graphing();
-- 
cgit v1.1