diff mbox series

[PATCHv2,11/12] extrahd.cgi: Do not allow "/mnt" or "/media" as mount points

Message ID 20230801154839.2373-11-stefan.schantl@ipfire.org
State Staged
Commit 19a3b883ded2a4960ae841212fb59c4600fca92d
Headers
Series [PATCHv2,01/12] extrahd.cgi: Add various perl functions deal with block devices |

Commit Message

Stefan Schantl Aug. 1, 2023, 3:48 p.m. UTC 
  Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 html/cgi-bin/extrahd.cgi | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Bernhard Bitsch Aug. 2, 2023, 12:11 p.m. UTC | #1 
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>


Am 01.08.2023 um 17:48 schrieb Stefan Schantl:
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
>   html/cgi-bin/extrahd.cgi | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi
> index 122f1d12d..bd64dff07 100644
> --- a/html/cgi-bin/extrahd.cgi
> +++ b/html/cgi-bin/extrahd.cgi
> @@ -667,6 +667,10 @@ sub is_mounted ($) {
>   sub is_valid_dir ($) {
>   	my ($mpoint) = @_;
>   
> +	# Do not allow "/mnt" or "/media" as mount points.
> +	return if($mpoint eq "/mnt");
> +	return if($mpoint eq "/media");
> +
>   	# Split the given mountpoint into pieces and store them
>   	# in a temporay array.
>   	my @tmp = split("/", $mpoint);
diff mbox series

Patch

diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi
index 122f1d12d..bd64dff07 100644
--- a/html/cgi-bin/extrahd.cgi
+++ b/html/cgi-bin/extrahd.cgi
@@ -667,6 +667,10 @@  sub is_mounted ($) {
 sub is_valid_dir ($) {
 	my ($mpoint) = @_;
 
+	# Do not allow "/mnt" or "/media" as mount points.
+	return if($mpoint eq "/mnt");
+	return if($mpoint eq "/media");
+
 	# Split the given mountpoint into pieces and store them
 	# in a temporay array.
 	my @tmp = split("/", $mpoint);