diff mbox series

[10/16] calamaris.dat: Fixes bug 13886

Message ID 20250925111252.11893-10-adolf.belka@ipfire.org
State Staged
Commit 3092a796c138c0b8b22563b68dd21d8e5e1c37e8
Headers
Series [01/16] fwhosts.cgi Fix for bug 13876 & bug 13877 |

Commit Message

Adolf Belka 25 Sep 2025, 11:12 a.m. UTC 
Fixes: bug 13886 - calamaris.dat Multiple Parameters Command Injection
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 html/cgi-bin/logs.cgi/calamaris.dat | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/html/cgi-bin/logs.cgi/calamaris.dat b/html/cgi-bin/logs.cgi/calamaris.dat
index dcc812e47..1c8e4b68e 100644
--- a/html/cgi-bin/logs.cgi/calamaris.dat
+++ b/html/cgi-bin/logs.cgi/calamaris.dat
@@ -170,6 +170,10 @@  if ($reportsettings{'ACTION'} eq $Lang::tr{'calamaris create report'})
 
 	if ($reportsettings{'RUN_BACKGROUND'} eq 'on') { $commandline.=" &"; }
 
+	if (!($commandline =~ /^[a-zA-Z0-9-\s]+$/))
+	{
+		die "Invalid input in\"$commandline\"";
+	}
 	system("${General::swroot}/proxy/calamaris/bin/mkreport $commandline")
 }