From patchwork Thu Sep 25 11:12:37 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9115 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKs1K1nz3wk8 for ; Thu, 25 Sep 2025 11:13:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWKq6wf0z450 for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKp2t7Kz2yql for ; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKl5B3xz2xQT for ; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKk2vXKzHW; Thu, 25 Sep 2025 11:13:14 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798794; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=K7lAGHuw5HQg5BHGdMkRpMJZ0y33+Eq1n7EnDIvc8WU=; b=tVN3PM18ToY/MDCnpQiU9Cp/qNZ3IEe5vOGsBWU9tAkYL0RqjvHuHdaetw9HE9h2bFGklT ua/kiMigTEzLmrAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798794; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=K7lAGHuw5HQg5BHGdMkRpMJZ0y33+Eq1n7EnDIvc8WU=; b=Mtn9beySxqirU6CEbrdvKdOg3WaB1WZDGtBy+w3k7/lClDhMrFom11q3G+F8QECAsOerf0 nxXsRv8xcn5FG8702BBZLZiS0bw76x+ho+VUInCA2pIH99R+OiQTSn6Fw7tKrkMdonBhbW sW5A3q7eA4FZRQ6zM9iabzpa0SoscYylwtJxeqpBbhMG1v26RBnkvi/M7nKBKoKmJwoEBB KLZP3x5lsSQYz5EAUm4uBaKd4PhCouX8ZwsvGR/68skSwQhx5zqyG/dtOMU1z7VhM3x665 cWWxdrbGOg1Qhhwq3BsRX7rQda6qdOE7yiWw0ve4pfPVZfZ+KOvFqJX+msG5Ew== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 01/16] fwhosts.cgi Fix for bug 13876 & bug 13877 Date: Thu, 25 Sep 2025 13:12:37 +0200 Message-ID: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: Bug 13876 savelocationgrp COUNTRY_CODE Stored Cross-Site Scripting Fixes: Bug 13877 saveservice PROT Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/fwhosts.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index 953f81e5f..a666969b0 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2013 Alexander Marx # +# Copyright (C) 2013-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -714,7 +714,7 @@ if ($fwhostsettings{'ACTION'} eq 'savelocationgrp') } if ($fwhostsettings{'update'} eq 'on'){ - @target=$fwhostsettings{'COUNTRY_CODE'}; + @target=&Header::escape($fwhostsettings{'COUNTRY_CODE'}); $type='Location Group'; #check if host/net exists in grp @@ -796,7 +796,7 @@ if ($fwhostsettings{'ACTION'} eq 'saveservice') foreach my $i (0 .. 4) { $customservice{$key}[$i] = "";} $customservice{$key}[0] = $fwhostsettings{'SRV_NAME'}; $customservice{$key}[1] = $fwhostsettings{'SRV_PORT'}; - $customservice{$key}[2] = $fwhostsettings{'PROT'}; + $customservice{$key}[2] = &Header::escape($fwhostsettings{'PROT'}); $customservice{$key}[3] = $ICMP; &General::writehasharray("$configsrv", \%customservice ); #reset fields From patchwork Thu Sep 25 11:12:38 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9117 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKs6blZz3x7N for ; Thu, 25 Sep 2025 11:13:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWKr4YfVz45h for ; Thu, 25 Sep 2025 11:13:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKq0GPSz30FL for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKm2WFCz32dW for ; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKl1gQlz3P3; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xP6MWLJc80+WBNer4mGbtlG/9FtReZPOhtGZY1QrgCM=; b=oDk/CPbXrLKxTQhFA1LAThahC3S3pl59Z5NJ1BbVzkofEq1wfkd4R2UAFNPbBEs2yaIE9x YyBBrJJS2lVZsqAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xP6MWLJc80+WBNer4mGbtlG/9FtReZPOhtGZY1QrgCM=; b=wtQeDkBUwKWLbZCJIoHFuSC18FOlF8W+0fgqSVZoQqzeC24lcWd+z2D4YzqbK4C2yT2Obp n1wFRxi34Yak50+gNDA/Et2qDOtOcg4KsOFFIoyFFZI7220icYVOCvNm9824y/UfoREDJW hSP8f/l1oa5MWUN1DxcQtvGnY5SM9fLUt4+wwMJZYWLF8dscYui0Z+FBspIH2I2f8M0lk4 fvmSt/cO5dnS4XyaWsutvyg67ciODcEf7lwbkYuAJL+pOU17WOe0HQZcFw13B8zk+imy5F NWiNjyMpYfMvWRV9N6HeCJUguElJ51MSwuNFALziUWyDhBCGzpEvB0tpxVVxSw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 02/16] ids.cgi: Fixes bug 13878 Date: Thu, 25 Sep 2025 13:12:38 +0200 Message-ID: <20250925111252.11893-2-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13878 - IGNORE_ENTRY_REMARK Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/ids.cgi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 994872564..9c6b393f6 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team # +# Copyright (C) 2007-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -105,7 +105,7 @@ if (($cgiparams{'WHITELIST'} eq $Lang::tr{'add'}) || ($cgiparams{'WHITELIST'} eq # Assign hash values. my $new_entry_address = $cgiparams{'IGNORE_ENTRY_ADDRESS'}; - my $new_entry_remark = $cgiparams{'IGNORE_ENTRY_REMARK'}; + my $new_entry_remark = &Header::escape($cgiparams{'IGNORE_ENTRY_REMARK'}); # Read-in ignoredfile. &General::readhasharray($IDS::ignored_file, \%ignored) if (-e $IDS::ignored_file); From patchwork Thu Sep 25 11:12:39 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9116 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKs1bp3z3x7L for ; Thu, 25 Sep 2025 11:13:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWKq719sz453 for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKp2czTz32gm for ; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKl5CGmz2xph for ; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKl34fVz3R4; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NSBAhvuV/QYGxga1zGZnJKaCX73bRDU+5IrAOwV3Ox8=; b=Z0IovG68a5So5Ahe8NhlHSt7zp8ZMwASXdBIUiuHbiC6s2Yn4vyfHae/3SDh1uhDVy4PwZ WX2epxrsn50I/IAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NSBAhvuV/QYGxga1zGZnJKaCX73bRDU+5IrAOwV3Ox8=; b=dPnkLHUHwi9c39jPwGnobiYoheq+IW/3Ir4NyWKaAjewg7O7BakjcKBFieXPpLPNx/bpsl 3N/wl7NkFa++cwZW3pUZb5aEPcYqfWHQWg63tu8UDZkIJ6h9VBieuYpwpkbcZjGnrqHZZM BHKpawOFCdoKuCfWoGwLHxHxQiu0S0sOAwya4bI6LItqK7spDhmcecIIv0LUwwPa8RL4sN /mcXPQfnYCgLppVk7UmAudqpfI6uabq0V4+XKflm1m3neyeyTikCZzL+ArMrGOp/UXFzv7 eOg6537ZiMGhiCNVj2D+B8NT5XCfZoGD5sbfHyB6YGgj97QiQAM6CpBAb+QrUA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 03/16] ovpnclients.dat: Fixes bug 13879 Date: Thu, 25 Sep 2025 13:12:39 +0200 Message-ID: <20250925111252.11893-3-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13879 - CONNECTION_NAME SQL Injection Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/logs.cgi/ovpnclients.dat | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/logs.cgi/ovpnclients.dat b/html/cgi-bin/logs.cgi/ovpnclients.dat index 8fbf4f8fa..5e6baef3c 100644 --- a/html/cgi-bin/logs.cgi/ovpnclients.dat +++ b/html/cgi-bin/logs.cgi/ovpnclients.dat @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2020 IPFire Team # +# Copyright (C) 2020 - 2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -141,7 +141,7 @@ my $database_query = qq( ORDER BY common_name, duration DESC; ); -if ($cgiparams{'CONNECTION_NAME'}) { +if (($cgiparams{'CONNECTION_NAME'}) && ($cgiparams{'CONNECTION_NAME'} =~ /^[a-zA-Z0-9]+$/)) { $database_query = qq( SELECT common_name, DATETIME(connected_at, 'localtime'), DATETIME(disconnected_at, 'localtime'), bytes_received, bytes_sent, STRFTIME('%s', DATETIME(disconnected_at)) - STRFTIME('%s', DATETIME(connected_at)) AS duration FROM sessions From patchwork Thu Sep 25 11:12:40 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9118 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKs6mf0z3xF1 for ; Thu, 25 Sep 2025 11:13:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWKr4bKSz45m for ; Thu, 25 Sep 2025 11:13:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKq003Lz337n for ; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKm2TqWz32cx for ; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKl4SBDz3R5; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dIV1lOSHKaAyj/4VewCNflfvFm+fx+fdC/bTZR40j5M=; b=rsHVU33gcimHJ/YPAmGeDL8jsIsaNXuncfb6xJUTEycCeH/spWSOJxnsY+dj+7FzGEp5S8 u4FAmLX8c5JUt9DA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dIV1lOSHKaAyj/4VewCNflfvFm+fx+fdC/bTZR40j5M=; b=Ra76DIELEvt1w02vkZ8fRZrvaUKIni6cm6Vr5/WlxyYuQ74BKf0DRKC7msCrVxksCL4abU S7b5oFQQ+P6E3iaKmbYPpfNSsDMn/SnFlTPvQXLAE9fT5u/kDJ6ibIVwymqNef+x05RggF lwWWC9TboSnaVIqwLV9RVvtnJBerPuRnId25D1UnBx09AjYDt6WTmoDAIgqLbBnT46cttu kv8mJFHDmKhVfnuGCIk2wpXa9VwSeyOjU63zD7oJhNx7HEpAyg91zjqMm0GthK5gkAFuB5 xT9/1qpaVAJTgDNvG6tchJJElis2lskSA0p6tTA9wxZkmUSs3eIcDuUpDT4aIw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 04/16] header.pl: Fixes bug 13880 Date: Thu, 25 Sep 2025 13:12:40 +0200 Message-ID: <20250925111252.11893-4-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13880 - cleanhtml() Unchecked Return Value Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- config/cfgroot/header.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index 9492b467d..6e65f4137 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -647,7 +647,7 @@ sub cleanhtml { # decode the UTF-8 text so that characters with diacritical marks such as # umlauts are treated correctly by the escape command $outstring = &Encode::decode("UTF-8",$outstring); - escape($outstring); + $outstring = escape($outstring); # encode the text back to UTF-8 after running the escape command $outstring = &Encode::encode("UTF-8",$outstring); return $outstring; From patchwork Thu Sep 25 11:12:41 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9119 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKs70g3z3xPW for ; Thu, 25 Sep 2025 11:13:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWKr4czLz45q for ; Thu, 25 Sep 2025 11:13:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKq02DBz337s for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKm2WCQz32dS for ; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKl67kwzHW; Thu, 25 Sep 2025 11:13:15 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ChnbCdvMRIn/8mxhnOG+/AI27OD2stj8NWYPF2JeS4I=; b=Z23sa6i58gEjgmb8jxirkulzYQp0hzRoZOWK5ZbhqlASEpRon4jcWHR3Y6ms7RjxE4k5Gj mOCVAqoWAGA2slAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798795; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ChnbCdvMRIn/8mxhnOG+/AI27OD2stj8NWYPF2JeS4I=; b=YqVHyWYFP9evaMhRviCpoyLSiTFH1BmM3H151CVbsCLxZHGLpdDbTnWgT2pJC1U1o82z+D d4QhdPezcPV4hl0LiVVpa1VoCF0YQjWLNuRShX0M+C79iEDhYbVubtQ01bwowIaVCeHSl+ p2nKPC2i6SLcspHJlFBon8WePZzzUfYsYz4LfdBNt3ex9/sC6GvnUbVfGpFaMuGL3WIumb B8QptZIkc7L4cG4T+92t/fPmPs71ADeV94F9T+iHvo9vgCZiNX2IRXpwo03PoV9F0G3PHn pWjH5k/dFOF0VXs8FenC+NktWhJSuOlTX152XBriDI/yxqjzm+1NpSq5qy1iJA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 05/16] firewalllogip.dat: Fixes bug 13881 Date: Thu, 25 Sep 2025 13:12:41 +0200 Message-ID: <20250925111252.11893-5-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13881 - firewalllogip.dat pienumber Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/logs.cgi/firewalllogip.dat | 31 ++++++++++++++++--------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/html/cgi-bin/logs.cgi/firewalllogip.dat b/html/cgi-bin/logs.cgi/firewalllogip.dat index a7c6e5f80..361fe526d 100644 --- a/html/cgi-bin/logs.cgi/firewalllogip.dat +++ b/html/cgi-bin/logs.cgi/firewalllogip.dat @@ -1,14 +1,23 @@ #!/usr/bin/perl -# -# SmoothWall CGIs -# -# This code is distributed under the terms of the GPL -# -# JC HERITIER -# page inspired from the initial firewalllog.dat -# -# Modified for IPFire by Christian Schmidt -# and Michael Tremer (www.ipfire.org) +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2025 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### use strict; use Getopt::Std; @@ -61,7 +70,7 @@ if ($settings{'showpie'} != 0) { $cgiparams{'showpie'} = $settings{'showpie'} }; if ($settings{'sortcolumn'} != 0) { $cgiparams{'sortcolumn'} = $settings{'sortcolumn'} }; &Header::getcgihash(\%cgiparams); -if ($cgiparams{'pienumber'} != 0) { $settings{'pienumber'} = $cgiparams{'pienumber'} }; +if ($cgiparams{'pienumber'} != 0) { $settings{'pienumber'} = &Header::escape($cgiparams{'pienumber'}) }; if ($cgiparams{'otherspie'} != 0) { $settings{'otherspie'} = $cgiparams{'otherspie'} }; if ($cgiparams{'showpie'} != 0) { $settings{'showpie'} = $cgiparams{'showpie'} }; if ($cgiparams{'sortcolumn'} != 0) { $settings{'sortcolumn'} = $cgiparams{'sortcolumn'} }; From patchwork Thu Sep 25 11:12:42 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9120 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL34BqFz3wk8 for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL163hpz46q for ; Thu, 25 Sep 2025 11:13:29 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKv3crFz363w for ; Thu, 25 Sep 2025 11:13:23 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKm2wNfz32fq for ; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKm16nSz3R4; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8ktrjBE3Nod7f0/MLKrk7gS+nQl143u4k1WXgBWAFhs=; b=O/oRd7d3m6u7Hf5aRWa7tgKFXcONmxiFEkTxUp1LN8uLoxduVFfaELcWW9qqPxFjf3mSJW aSWCIzFhk84hMrBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8ktrjBE3Nod7f0/MLKrk7gS+nQl143u4k1WXgBWAFhs=; b=YrC0Wzjpu5zYSBMtMXib1rJ8F9b6hGj+2vcN9nf16QA5stg7s7rwU8d3l0+XI9Ahk9B+IC zdvhWk8u0Yo8QmCEBibswTkyJrjAR96ACaR3Yr0pvhQzETuU2r/JRYeQXXBLt2YsPFNNOl hTOqMSvOXCZij53PsuJjFNumyE0QvNCSY85IWwfyKZIoDfL7MxTcEt/0HjHkPw65n60Esw /XZ1M5b9Ks8BdvtnfiDhmvqEr64WS6X1NrGXlcHgH+ljISc5UdWMANx8j0Pbn65S9xk2wh 0ZlseQbeTN7y8rVCUHMAtU2fPzsnHdwZP6qqpSnrQYaudijd6UTHA1lCcptKZQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 06/16] firewalllogcountry.dat: Fixes bug 13882 Date: Thu, 25 Sep 2025 13:12:42 +0200 Message-ID: <20250925111252.11893-6-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13882 - firewalllogcountry.dat pienumber Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/logs.cgi/firewalllogcountry.dat | 31 +++++++++++++------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/html/cgi-bin/logs.cgi/firewalllogcountry.dat b/html/cgi-bin/logs.cgi/firewalllogcountry.dat index 4e998a567..b7fded9e3 100644 --- a/html/cgi-bin/logs.cgi/firewalllogcountry.dat +++ b/html/cgi-bin/logs.cgi/firewalllogcountry.dat @@ -1,14 +1,23 @@ #!/usr/bin/perl -# -# SmoothWall CGIs -# -# This code is distributed under the terms of the GPL -# -# JC HERITIER -# page inspired from the initial firewalllog.dat -# -# Modified for IPFire by Christian Schmidt -# and Michael Tremer (www.ipfire.org) +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2025 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### use strict; use Getopt::Std; @@ -61,7 +70,7 @@ if ($settings{'showpie'} != 0) { $cgiparams{'showpie'} = $settings{'showpie'} }; if ($settings{'sortcolumn'} != 0) { $cgiparams{'sortcolumn'} = $settings{'sortcolumn'} }; &Header::getcgihash(\%cgiparams); -if ($cgiparams{'pienumber'} != 0) { $settings{'pienumber'} = $cgiparams{'pienumber'} }; +if ($cgiparams{'pienumber'} != 0) { $settings{'pienumber'} = &Header::escape($cgiparams{'pienumber'}) }; if ($cgiparams{'otherspie'} != 0) { $settings{'otherspie'} = $cgiparams{'otherspie'} }; if ($cgiparams{'showpie'} != 0) { $settings{'showpie'} = $cgiparams{'showpie'} }; if ($cgiparams{'sortcolumn'} != 0) { $settings{'sortcolumn'} = $cgiparams{'sortcolumn'} }; From patchwork Thu Sep 25 11:12:43 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9121 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL34WFXz3x7L for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL207Kdz3ry for ; Thu, 25 Sep 2025 11:13:30 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKv3lWPz3646 for ; Thu, 25 Sep 2025 11:13:23 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKm4Kqgz3028 for ; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKm2VMtz3X8; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vjfTnTW+ew5EFlPWYuDLpJO3omI19FYvGnl2dV/zJy4=; b=CU/ecof+gvvrdLxwo0p2HOKH6jM3imoIGfclb3SfHEwsQWZnNdWewcMm/Xo70ulrgXIcd0 e8GFhvfaqV2bMZAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vjfTnTW+ew5EFlPWYuDLpJO3omI19FYvGnl2dV/zJy4=; b=US5YMC6DH1nTBpbvPs7HwZtk0YK9UYcXK3z09C5fLa/TUS08HuACCAEIODYbbws6RAEOpU iGFrww42mtK0lyeTVAZHyTMgp+4VwQI39kcimrjGyPt7LtE1m30josLt3J7zLrFweTp0+x jhGZp/kLO4JnqLILA4vZvxvpcfLkkzolkYF5oBSIg8yZJ8n5gKUB/MQT3oFBeUNa9TQgCy dDwsGqRyBE+QqCzAgsdERV97UQiY4NLt5UGmPXPOZ2FypKFtPW84KiRY8BSKx8LkFm+kyl 7DZ1f2E5KQ17YJ0/Z2/DZBm++NLClv7C+O/ytLqyiG5DdHznrAfE6peq1RVQqg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 07/16] time.cgi: Fixes bug 13883 Date: Thu, 25 Sep 2025 13:12:43 +0200 Message-ID: <20250925111252.11893-7-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13883 - time.cgi UPDATE_VALUE Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/time.cgi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/time.cgi b/html/cgi-bin/time.cgi index 04c1e771f..d465354bb 100644 --- a/html/cgi-bin/time.cgi +++ b/html/cgi-bin/time.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2010 IPFire Team # +# Copyright (C) 2010-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -78,6 +78,7 @@ if ($timesettings{'ACTION'} eq $Lang::tr{'save'}) if (!($timesettings{'UPDATE_VALUE'} =~ /^\d+$/) || $timesettings{'UPDATE_VALUE'} <= 0) { $errormessage = $Lang::tr{'invalid time period'}; + $timesettings{'UPDATE_VALUE'} = 0; goto ERROR; } From patchwork Thu Sep 25 11:12:44 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9123 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL35Mqmz3xF1 for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL20NPWz3s9 for ; Thu, 25 Sep 2025 11:13:30 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKv4461z36V7 for ; Thu, 25 Sep 2025 11:13:23 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKn1Hz6z330q for ; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKm3w4dz3dm; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Mt7b160kn/O9QzBJ0sZ92sZpWRozjF/i6IhHkQhIvfA=; b=CJLJXJZebEb0WFlsjkrJM1wZ3981IVd+uMSOQ/ug1AEKRwepCXNF0O4sF9HarBhw8qL2PN eBpSuaL9yK+RYgBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Mt7b160kn/O9QzBJ0sZ92sZpWRozjF/i6IhHkQhIvfA=; b=qaw6j90JzQobip/GSTsTXTQ6ZKlkgUHkQO7XdHTo8UTSjVgLZ1gtNuxKdhPnSkfHWUsBO3 XK3OrEj3HEgbym8GDalK/O0Z33du+C++l9sMgaKUQBRTFYHswS/rya19olXr6MYuIZWZdu RtXTPpG+CQKZ3in07P0ejFf4XhIarJ0IsvptTrJSAb+zGgMbz+EGWDt3ka9I9/M2/h5lm/ vAbyBRkq2V44tm362zclZKbky+1n1Xf59OKxFUtGCxkr4SRd+76uFXvrSXtrck2X7TjOxX kimi5+8LLgxPAoRU4hif6YvM669fSltSRDYAJzNaGtsCKC54WJHQA91XgUXb5g== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 08/16] ddns.cgi: Fixes bug 13884 Date: Thu, 25 Sep 2025 13:12:44 +0200 Message-ID: <20250925111252.11893-8-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13884 - ddns.cgi LOGIN PASSWORD SERVICE Stored Cross-Site Scripting Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch --- html/cgi-bin/ddns.cgi | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index 34475b75c..60565da3f 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team # +# Copyright (C) 2007-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -226,6 +226,9 @@ if (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang:: flock FILE, 2; # Add account data to the file. + $settings{'SERVICE'} = &Header::escape(($settings{'SERVICE'}); + $settings{'LOGIN'} = &Header::escape(($settings{'LOGIN'}); + $settings{'PASSWORD'} = &Header::escape(($settings{'PASSWORD'}); print FILE "$settings{'SERVICE'},$hostname,$domain,$settings{'PROXY'},$settings{'WILDCARDS'},$settings{'LOGIN'},$settings{'PASSWORD'},$settings{'ENABLED'}\n"; # Close file after writing. From patchwork Thu Sep 25 11:12:45 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9122 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL34vVhz3x7N for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL20G24z45F for ; Thu, 25 Sep 2025 11:13:30 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKv3rTyz36V2 for ; Thu, 25 Sep 2025 11:13:23 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKn2xbpz32gh for ; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKm5Yk9z3v2; Thu, 25 Sep 2025 11:13:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VZaEE0sTgUhihzucPAdZugts+FFSatN254Tg9dzG9a0=; b=cqjCMYmLZ7c9WZIt2BSPiHvipqLmDkJdMVdxrjR8xosbt7ByzmdlwNRRdNHM66Pkucugfi YzyYLb8paUKnLLCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VZaEE0sTgUhihzucPAdZugts+FFSatN254Tg9dzG9a0=; b=cVNSzv4eSTCC/hlGXptfyi5LQV0euLNSpDHgdTvRALZ0kkS6lWVstiqQI1YIZTD2StzEr9 6nRWqvFlPU4uhIvHj7dE7ye7umZnQr9j3tBcgOgCEsersPGubRMhVT8ORtjnqKbMcRcG9f NebE77sSwsf6VnPE7fyAhk+vSRWcx9yLPE3f2PMaf/oPHFEhNnlpc/HbJYE9XuMnJXUzr9 uIlbFIfKcJ2hZPiwCvVYiE4nVNECU5QmXsRVn2c8MRCzRNDit8DaeYfi6rZ97wsSvQfrXF 4HrTHZn3aS4tBOWPbu2KOGnvdGUsyhs/9ttmoLWNDcQQ8kNlQdhFaTBx6D3N1w== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 09/16] qos.cgi: Fixes bug 13885 Date: Thu, 25 Sep 2025 13:12:45 +0200 Message-ID: <20250925111252.11893-9-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13885 - qos.cgi INC_SPD OUT_SPD DEFCLASS_INC DEFCLASS_OUT Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/qos.cgi | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/qos.cgi b/html/cgi-bin/qos.cgi index 52392be08..8400bafdf 100644 --- a/html/cgi-bin/qos.cgi +++ b/html/cgi-bin/qos.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team # +# Copyright (C) 2007-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -671,6 +671,8 @@ END END ; if (($qossettings{'OUT_SPD'} ne '') && ($qossettings{'INC_SPD'} ne '')) { + $qossettings{'OUT_SPD'} = &Header::escape($qossettings{'OUT_SPD'}); + $qossettings{'INC_SPD'} = &Header::escape($qossettings{'INC_SPD'}); print < @@ -683,6 +685,8 @@ END ; } if (($qossettings{'DEFCLASS_OUT'} ne '') && ($qossettings{'DEFCLASS_INC'} ne '')) { + $qossettings{'DEFCLASS_OUT'} = &Header::escape($qossettings{'DEFCLASS_OUT'}); + $qossettings{'DEFCLASS_INC'} = &Header::escape($qossettings{'DEFCLASS_INC'}); print <
From patchwork Thu Sep 25 11:12:46 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9124 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL45BF1z3wk8 for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL34DZ7z45T for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw0WgTz36Wr for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKn71Ncz333s for ; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKn0FN8z3wP; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FXKuA5a+Z0WRSsm4/fAYqd9pEkLEwVra0Gj7VlS3ZIs=; b=Xh+8qeZgU+xUfugfU7GpOV0yV1Fs1nbJeMpLBqnRbmMiJ/htLI87rlroOwFg8nln849yqh 600hh9CyvBvFsaAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FXKuA5a+Z0WRSsm4/fAYqd9pEkLEwVra0Gj7VlS3ZIs=; b=MniRUh5bxGGgKJw2fkjmNPqJ1afGLCVMYAW7WClJNd1TkUVPjf8DkT9jecsGTCRtVr7W4o lovlShsLbo5SykIF+hnPdtZYfWxi/aTaUN9aIARKlnQRpZjhOw3VoZ/4qpgmG0EkGF28+l pgBMx8DcGwjUzCoqPqg25GGhoU5fq/poA+z2iX6pOh/eL5cB5nvdcY10N+Q96Jzg4G0s0X 7Jxc8ARn6VaFL48vZ7TtEKL7tQpp3l6g/y5Mb3gSEiqeaUcKZDVeZEEYVW52SG3MJRQB1x zY4E7irJ0OHs+IaPgIk/O3h1aLUlP0Jw+6V/vl8gHlrtgIxdOdbjh8VyGbLnGQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 10/16] calamaris.dat: Fixes bug 13886 Date: Thu, 25 Sep 2025 13:12:46 +0200 Message-ID: <20250925111252.11893-10-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13886 - calamaris.dat Multiple Parameters Command Injection Signed-off-by: Adolf Belka --- html/cgi-bin/logs.cgi/calamaris.dat | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/html/cgi-bin/logs.cgi/calamaris.dat b/html/cgi-bin/logs.cgi/calamaris.dat index dcc812e47..1c8e4b68e 100644 --- a/html/cgi-bin/logs.cgi/calamaris.dat +++ b/html/cgi-bin/logs.cgi/calamaris.dat @@ -170,6 +170,10 @@ if ($reportsettings{'ACTION'} eq $Lang::tr{'calamaris create report'}) if ($reportsettings{'RUN_BACKGROUND'} eq 'on') { $commandline.=" &"; } + if (!($commandline =~ /^[a-zA-Z0-9-\s]+$/)) + { + die "Invalid input in\"$commandline\""; + } system("${General::swroot}/proxy/calamaris/bin/mkreport $commandline") } From patchwork Thu Sep 25 11:12:47 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9126 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL45hrgz3xQ9 for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL36GWNz3xK for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw18c3z331v for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKp1wVbz334Y for ; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKn2L1wz3xH; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SjlXYQB0lUDlKpbMqukYfqaHCaUdACGG1Q8iBitGzbg=; b=D5SwQ8iMz2Y94nw29DYuoDhicNq37p/qlxEZKlFw4lBUfC7YB2iWRguHzTTZ24bFAYJRnB v0xW1B+dZxnOvCDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SjlXYQB0lUDlKpbMqukYfqaHCaUdACGG1Q8iBitGzbg=; b=Uu/+j5DoYb4D9ev0/b6W/BC3iGRm1LEm6bZbRo0gwO0Z6JmfQXnxV7UQP0q0ORo0z7YD/0 Ckc7fdOh2NYJQXye9ofHcr7B5lw89Rn/fq3f0nLyinpHplinh/cQzSASDqs3qS9+oV9rGD xKmsOP7MSVa372QNLUJMiPE3h3CgDCKVmKHJyslIC7DwMc92AvOZVpAXcEpmkywg8be5eC hsuxkQo62afmHG+1HTb4KZed7wsKBQ2FYaWgaPjiS8YY2ilAqxrap/MKNyzyd+DLoEfqM1 X4ThRSL7daNe/wa/WLN0dYq6L9Db61iD5oynjdOxJ/sxxT9FmqfJ3ttdID+dDg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 11/16] urlfilter.cgi: Fixes bugs 13887, 13888 & 13889 Date: Thu, 25 Sep 2025 13:12:47 +0200 Message-ID: <20250925111252.11893-11-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13887 - urlfilter.cgi BE_NAME Command Injection Fixes: bug 13888 - urlfilter.cgi USERQUOTA QUOTA_USERS Stored Cross-Site Scripting Fixes: bug 13889 - urlfilter.cgi TIMECONSTRAINT SRC DST COMMENT Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/urlfilter.cgi | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/urlfilter.cgi b/html/cgi-bin/urlfilter.cgi index 1ced06e26..2467f297c 100644 --- a/html/cgi-bin/urlfilter.cgi +++ b/html/cgi-bin/urlfilter.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2005-2010 IPFire Team # +# Copyright (C) 2005-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -576,7 +576,7 @@ if (($uqsettings{'MODE'} eq 'USERQUOTA') && ($uqsettings{'ACTION'} eq $Lang::tr{ $_ = $uqsettings{'QUOTA_USERS'}; chomp; s/\n/|/g; - my $quota_users = $_; + my $quota_users = &Header::escape($_); if ($uqsettings{'QUOTA_USERS'} =~ /\\/) { @@ -936,6 +936,11 @@ if (($besettings{'ACTION'} eq $Lang::tr{'urlfilter install blacklist'}) && ($bes close FILE; # XXX uses globbing + if(!($besettings{'BE_NAME'} =~ /^[a-zA-Z0-9-_]+$/)) + { + $errormessage = 'Invalid blacklist name (use only alphanumeric characters plus hyphens or underscores)'; + goto ERROR; + } system("rm -f $dbdir/$besettings{'BE_NAME'}/*.db"); &General::system("/usr/bin/squidGuard", "-c", "$editdir/install.conf", "-C", "all"); # XXX uses globbing @@ -2047,6 +2052,10 @@ foreach $line (@tclist) if ($temp[7] eq 'on') { $time.=$Lang::tr{'urlfilter sun'}; } else { $time.='='; } $time=$time.'   '.$temp[8].':'.$temp[9].' to '.$temp[10].':'.$temp[11]; + $temp[12] = &Header::escape($temp[12]); + $temp[13] = &Header::escape($temp[13]); + $temp[16] = &Header::escape($temp[16]); + print <$temp[0] From patchwork Thu Sep 25 11:12:48 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9129 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL469vJz3xRR for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL36YkTz45F for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw1MvCz3399 for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKp46hfz335S for ; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKn4Jjkz40Z; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v5fyhUSHMHMt4X+Pmob5g9b04JvwBhdZTiryZnkN4P4=; b=KMCATzOI7VQmBxH5o4rj0Y/k0M71hOc56BIXTLI2P9nbxpFDy5FoqcvFNO9vIkTUf5L0KH oMQX7v5YkUJOjrDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798797; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v5fyhUSHMHMt4X+Pmob5g9b04JvwBhdZTiryZnkN4P4=; b=WEqOTYvOzOeSV5OJMBYEP05YTqRi1lELQGqPyo5HnlJmsMb6Uhjuyn44BSRhtgMdI7m5lZ paEQV4uA3kmEKvaFXj933yYqJaxGsd/ujDZYrNYdUMyxZNkCcAVmRczUTuNXhWSBGUrwcm etmOJYuCsSrJYs2aDlywk8C7ct24OmpiXgQagCGpPSw8gTiiSMdqCVbqifj94V43bidihz BF0HZBYaGYfROvAWCq3fuRd3ojBxMsMik66AiW1FFNtJCIEAsCN7z3u/Ts8UQJGrzwIwhV 5h2MULdkbH3lAhvsgVSSiC8ZeDEIYYsPmGY5VzOZ34S2bKWc0YmgBEDybqYDfA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 12/16] config.dat: Fixes bug 13890 Date: Thu, 25 Sep 2025 13:12:48 +0200 Message-ID: <20250925111252.11893-12-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13890 - config.dat REMOTELOG_ADDR Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/logs.cgi/config.dat | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/html/cgi-bin/logs.cgi/config.dat b/html/cgi-bin/logs.cgi/config.dat index aed0db9cf..e4b173ffb 100644 --- a/html/cgi-bin/logs.cgi/config.dat +++ b/html/cgi-bin/logs.cgi/config.dat @@ -1,13 +1,23 @@ #!/usr/bin/perl -# -# IPFire CGIs -# -# This code is distributed under the terms of the GPL -# -# (c) The IPFire Team -# -# $Id: config.dat,v 1.2.2.10 2005/06/14 12:32:07 eoberlander Exp $ -# +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2025 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### use strict; @@ -143,6 +153,7 @@ END &Header::closebox(); &Header::openbox('100%', 'left', $Lang::tr{'remote logging'}); +$logsettings{'REMOTELOG_ADDR'} = &Header::escape($logsettings{'REMOTELOG_ADDR'}); print < From patchwork Thu Sep 25 11:12:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9125 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL45XWWz3xPW for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL368drz3tH for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw13Hnz32pV for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKq1NWHz3390 for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKn6lQzz41g; Thu, 25 Sep 2025 11:13:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2gtFf956VNq8sGe0c0SHZ+74sFr0DPOErQW7VAhacFw=; b=FKG/ymIUR0cM+UtrcsIlQaQpnF2q7SyLh0UX7tsZZFN1LG1EwZpCJ8bU+9vbbPhU5UunUS 5nq1H1JKLFjsS0DA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2gtFf956VNq8sGe0c0SHZ+74sFr0DPOErQW7VAhacFw=; b=VZe09kHrKBvDkoEgtLegEV7UK4xD9Rq4Qn0HEcSgz+qm69/bsduUgw41+C5M06/TNPyYUJ wWl2KcSGG2FiS1QF27WW6dwFSBP3qsQQJcgltdRIhCZTekpmFaRwuyjP3vMGWg0vFwnUcZ rKKhUZrKJIHOSxYBRMDIes+5HN10AHLJ2IobPBZu3BME3laxq4ShP/usIecWza+LDvtht9 go1Ze/LbS+pQeETmhue3DttVss6OCSbzbxQLIF7NAFBq/IygBHRYw4QWleGltOvi7Xd+kD L1pZWrYDw2PPB2r85zKbyc2a1F3+kQ6VoID8sXAIEyv6ji1whr7otDNqdUFKdQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 13/16] mail.cgi: Fixes bug 13891 Date: Thu, 25 Sep 2025 13:12:49 +0200 Message-ID: <20250925111252.11893-13-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13891 - mail.cgi txt_mailuser txt_mailpass Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/mail.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi index 0ed3dfeca..aae4abc31 100644 --- a/html/cgi-bin/mail.cgi +++ b/html/cgi-bin/mail.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team # +# Copyright (C) 2007-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -102,8 +102,8 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite $mail{'RECIPIENT'} = $cgiparams{'txt_recipient'}; if ($cgiparams{'txt_mailuser'} && $cgiparams{'txt_mailpass'}) { - $auth{'AUTHNAME'} = $cgiparams{'txt_mailuser'}; - $auth{'AUTHPASS'} = $cgiparams{'txt_mailpass'}; + $auth{'AUTHNAME'} = &Header::escape($cgiparams{'txt_mailuser'}); + $auth{'AUTHPASS'} = &Header::escape($cgiparams{'txt_mailpass'}); $auth{'AUTHHOST'} = $cgiparams{'txt_mailserver'}; print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n"; } From patchwork Thu Sep 25 11:12:50 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9127 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL45sqmz3xQs for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL36J1rz40G for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw1Db4z32pF for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKq2k51z3336 for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKp1Z2mz42N; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0PKJLA+jB2U8GoZqorXhUy1aACRYsZzNs4hNMS9mBPU=; b=YdYg3bBxXE2V1I2r7PArqFDRm4c0DWCDJTTaEuyw70xClzyNLPBlEPovis6nTbCjpQmd8z /tsQfGuPPc1mc6Dw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0PKJLA+jB2U8GoZqorXhUy1aACRYsZzNs4hNMS9mBPU=; b=Ypudk6bWCyI40J/Q6Piy2Dzny2DsZsmYMpSje9FpuUTCHO9Dfb01k6Bj7bX044Xiweb4MW +1CuVO+UbVc+Hgla0KktCE5QczIcGEs9ZfdDo5lA4zfK3kzwcWc9PprHkkdD6y2AIVmOvz +jo0q50UME86wa7fv3GU0NWL+x+ASHpG2ZUBflJzD+kQUEPMrmvmsEmE9BSfD1kzEQGDMS vSQUX13Nwi1eAPnK8WXJHLyICQardE5viUbQAN4CWB4ZR1RiGDhz7Vw8CCE7cmf9X4XQUc Zdalq/QSvqgt/uc8+Z5LFAdRDR0CUZ2X03QyVZhPJ+YhiROUOUntHMjsYZD6fw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 14/16] dns.cgi: Fixes bug 13892 Date: Thu, 25 Sep 2025 13:12:50 +0200 Message-ID: <20250925111252.11893-14-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13892 - dns.cgi TLS_HOSTNAME Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/dns.cgi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi index 0d3b14797..a4f1c719e 100644 --- a/html/cgi-bin/dns.cgi +++ b/html/cgi-bin/dns.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2005-2024 IPFire Team # +# Copyright (C) 2005-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -187,6 +187,7 @@ if (($cgiparams{'SERVERS'} eq $Lang::tr{'save'}) || ($cgiparams{'SERVERS'} eq $L } # Add/Modify the entry to/in the dns_servers hash. + $cgiparams{'TLS_HOSTNAME'} = &Header::escape($cgiparams{'TLS_HOSTNAME'}); $dns_servers{$id} = ["$cgiparams{'NAMESERVER'}", "$cgiparams{'TLS_HOSTNAME'}", "$status", "$cgiparams{'REMARK'}"]; # Write the changed hash to the config file. From patchwork Thu Sep 25 11:12:51 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9128 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWL45yj2z3xR0 for ; Thu, 25 Sep 2025 11:13:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL36RSMz41g for ; Thu, 25 Sep 2025 11:13:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWKw1PnCz339B for ; Thu, 25 Sep 2025 11:13:24 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKq4s9bz332y for ; Thu, 25 Sep 2025 11:13:19 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKp3N61z43s; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kaT/FeMSSqQPVCcXHjLso4C+dZpjZ2tcoE+5tPZeiTc=; b=DK606BRgOwXh3mIhvR0MSvFK421FQi77K+vT3GhZRwROZSqd6MGVLYAnv5462LvyoK///D KpCPIpXMhEE0OpDQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kaT/FeMSSqQPVCcXHjLso4C+dZpjZ2tcoE+5tPZeiTc=; b=wjfR+qQn2Zq+wqBgoS68csGCeowX7hgfXwfLCxGLW3dUnr0SHxzdiWkMIiQ9+8yp86hBnv X9nEeJTBS5KB7e2spn3DGoXRpPsAtcJvXeKbISzk70I7CCnBHf2wDft4yUW66OGlgra5q5 8qaenCp8hCFuewXAXtQfzIZjXsZe8C4DFYZg/sqJepBFGF3KcLAk/pVFCji/ocs9e23I/c C/Z7Wo3hu/M+K4W54XllYfbkEJc1qrqtCB7Q/p7w26bQq0ofNWkbDmr9GRcWwsgr3WQqic cwal43KPCYavKp6JGvbt3muxY7baatlBKcZhRYMNwH6ZdRVqy3zkA3SeknJ1ww== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 15/16] proxy.cgi: Fixes bug 13893 Date: Thu, 25 Sep 2025 13:12:51 +0200 Message-ID: <20250925111252.11893-15-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Fixes: bug 13893 - proxy.cgi Multiple Parameters Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/proxy.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index bdce2fa66..1ade39381 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -3973,6 +3973,7 @@ END { print FILE " $mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}\n\n"; } else { + $proxysettings{'VISIBLE_HOSTNAME'} = &Header::escape($proxysettings{'VISIBLE_HOSTNAME'}); print FILE " $proxysettings{'VISIBLE_HOSTNAME'}\n\n"; } From patchwork Thu Sep 25 11:12:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9130 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4cXWLB1qvgz3wk8 for ; Thu, 25 Sep 2025 11:13:38 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cXWL96Fn5z42h for ; Thu, 25 Sep 2025 11:13:37 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cXWL06tzJz335C for ; Thu, 25 Sep 2025 11:13:28 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cXWKr0F8kz334n for ; Thu, 25 Sep 2025 11:13:20 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4cXWKp5RQ5z447; Thu, 25 Sep 2025 11:13:18 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WyE78U7W0VVPTSBbK2WaVHdmLcSv9zYjH1LzQZ3T+r8=; b=3zNKyD0nG3xGx72gBwgM3KMo3wgNSMHWiQxoDsXArZz/OupnrMUfQNKH8/M7d3IW0Aqiqz Slnw8xMxQCB9VMDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758798798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WyE78U7W0VVPTSBbK2WaVHdmLcSv9zYjH1LzQZ3T+r8=; b=M+rGZBhcBEaZXHGcs8dJ7pse/s3PQJK45vzG5qoyuY22F3JPSFwCyBAvZIUWYjkgMExFlp W54ITOaNpFaR6U52V1yfA+LRoT4OA7E0w5tj6uBOKe7D8lEWdVh592z2FMzBVpFYif+kaK mAp9SLhogA3gqaSigLwmMJ0ZZ7UbOBH4pvg483emm/xCoqKg/dn0CPP+l6fTexoZXyfmp4 tU9hj+c/hUzkLd61t8Sm8u2tvfrJvYLngmbZWGQRbhdurV7mDwK5zWP4tFoEriibzBTCSm 0SEQevJplLRTgj8EfgGzxJFwCvCq/m8MhrNfKZMtD5lSESPHwyg7mU5SyG4Ulg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 16/16] proxy.cgi: Further fix for bug 13893 Date: Thu, 25 Sep 2025 13:12:52 +0200 Message-ID: <20250925111252.11893-16-adolf.belka@ipfire.org> In-Reply-To: <20250925111252.11893-1-adolf.belka@ipfire.org> References: <20250925111252.11893-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Previous patch for proxy.cgi was related to the mitigation provided by the bug reporter for the parameter VISIBLE_HOSTNAME. This parameter however was not mentioned in the description for that bug. - bug 13893 description mentions TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD but it mentions them as being from dns.cgi which is incorrect except for TLS_HOSTNAME. - The other parameters are from proxy.cgi but no mitigation was shown for those in the bug report. - This patch adds fixes for the parameters UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD Fixes: bug 13893 - proxy.cgi Multiple Parameters Stored Cross-Site Scripting Signed-off-by: Adolf Belka --- html/cgi-bin/proxy.cgi | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index 1ade39381..3fbd78d2c 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -3977,8 +3977,16 @@ END print FILE " $proxysettings{'VISIBLE_HOSTNAME'}\n\n"; } - if (!($proxysettings{'ADMIN_MAIL_ADDRESS'} eq '')) { print FILE "cache_mgr $proxysettings{'ADMIN_MAIL_ADDRESS'}\n"; } - if (!($proxysettings{'ADMIN_PASSWORD'} eq '')) { print FILE "cachemgr_passwd $proxysettings{'ADMIN_PASSWORD'} all\n"; } + if (!($proxysettings{'ADMIN_MAIL_ADDRESS'} eq '')) + { + $proxysettings{'ADMIN_MAIL_ADDRESS'} = &Header::escape($proxysettings{'ADMIN_MAIL_ADDRESS'}); + print FILE "cache_mgr $proxysettings{'ADMIN_MAIL_ADDRESS'}\n"; + } + if (!($proxysettings{'ADMIN_PASSWORD'} eq '')) + { + $proxysettings{'ADMIN_PASSWORD'} = &Header::escape($proxysettings{'ADMIN_PASSWORD'}); + print FILE "cachemgr_passwd $proxysettings{'ADMIN_PASSWORD'} all\n"; + } print FILE "\n"; print FILE "max_filedescriptors $proxysettings{'FILEDESCRIPTORS'}\n\n"; @@ -3994,8 +4002,13 @@ END # login=*:password ($proxysettings{'FORWARD_USERNAME'} eq 'on') if (($proxy1 eq 'YES') || ($proxy1 eq 'PASS')) { + $proxysettings{'UPSTREAM_USER'} = &Header::escape($proxysettings{'UPSTREAM_USER'}); print FILE " login=$proxysettings{'UPSTREAM_USER'}"; - if ($proxy1 eq 'YES') { print FILE ":$proxysettings{'UPSTREAM_PASSWORD'}"; } + if ($proxy1 eq 'YES') + { + $proxysettings{'UPSTREAM_PASSWORD'} = &Header::escape($proxysettings{'UPSTREAM_PASSWORD'}); + print FILE ":$proxysettings{'UPSTREAM_PASSWORD'}"; + } } elsif ($proxysettings{'FORWARD_USERNAME'} eq 'on') { print FILE " login=*:password"; }
$time