Projet

Général

Profil

« Précédent | Suivant » 

Révision 2f9951fe

Ajouté par Renato Botelho il y a presque 10 ans

Add some protection to parameters that come through _GET

Voir les différences:

etc/inc/service-utils.inc
515 515 
			services_radvd_configure();
516 516 
			break;
517 517 
		case 'captiveportal':
518 
			$zone = $extras['zone'];
518 
			$zone = htmlspecialchars($extras['zone']);
519 519 
			captiveportal_init_webgui_zonename($zone);
520 520 
			break;
521 521 
		case 'ntpd':
......
553 553 
			send_event("service restart sshd");
554 554 
			break;
555 555 
		case 'openvpn':
556 
			$vpnmode = isset($extras['vpnmode']) ? $extras['vpnmode'] : $extras['mode'];
556 
			$vpnmode = isset($extras['vpnmode']) ? htmlspecialchars($extras['vpnmode']) : htmlspecialchars($extras['mode']);
557 557 
			if (($vpnmode == "server") || ($vpnmode == "client")) {
558 
				$id = isset($extras['vpnid']) ? $extras['vpnid'] : $extras['id'];
558 
				$id = isset($extras['vpnid']) ? htmlspecialchars($extras['vpnid']) : htmlspecialchars($extras['id']);
559 559 
				$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
560 560 
				if (file_exists($configfile))
561 561 
					openvpn_restart_by_vpnid($vpnmode, $id);
......
577 577 
			killbypid("{$g['varrun_path']}/radvd.pid");
578 578 
			break;
579 579 
		case 'captiveportal':
580 
			$zone = $extras['zone'];
580 
			$zone = htmlspecialchars($extras['zone']);
581 581 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
582 582 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
583 583 
			break;
......
624 624 
			exec("/usr/local/sbin/ipsec stop");
625 625 
			break;
626 626 
		case 'openvpn':
627 
			$vpnmode = $extras['vpnmode'];
627 
			$vpnmode = htmlspecialchars($extras['vpnmode']);
628 628 
			if (($vpnmode == "server") or ($vpnmode == "client")) {
629 
				$id = $extras['id'];
629 
				$id = htmlspecialchars($extras['id']);
630 630 
				$pidfile = "{$g['varrun_path']}/openvpn_{$vpnmode}{$id}.pid";
631 631 
				killbypid($pidfile);
632 632 
			}
......
648 648 
			services_radvd_configure();
649 649 
			break;
650 650 
		case 'captiveportal':
651 
			$zone = $extras['zone'];
651 
			$zone = htmlspecialchars($extras['zone']);
652 652 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
653 653 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
654 654 
			captiveportal_init_webgui_zonename($zone);
......
692 692 
			send_event("service restart sshd");
693 693 
			break;
694 694 
		case 'openvpn':
695 
			$vpnmode = $extras['vpnmode'];
695 
			$vpnmode = htmlspecialchars($extras['vpnmode']);
696 696 
			if ($vpnmode == "server" || $vpnmode == "client") {
697 
				$id = $extras['id'];
697 
				$id = htmlspecialchars($extras['id']);
698 698 
				$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
699 699 
				if (file_exists($configfile))
700 700 
					openvpn_restart_by_vpnid($vpnmode, $id);
usr/local/www/status_services.php
41 41 
require_once("service-utils.inc");
42 42 
require_once("shortcuts.inc");
43 43 

  		




  44
  
  
    
if (!empty($_GET['service'])) {


  		




  
  44
  
    
$service_name = '';


  		




  
  45
  
    
if (isset($_GET['service']))


  		




  
  46
  
    
	$service_name = htmlspecialchars($_GET['service']);


  		




  
  47
  
    

  		




  
  48
  
    
if (!empty($service_name)) {


  		




  45
  49
  
    
	switch ($_GET['mode']) {


  		




  46
  50
  
    
		case "restartservice":


  		




  47
  
  
    
			$savemsg = service_control_restart($_GET['service'], $_GET);


  		




  
  51
  
    
			$savemsg = service_control_restart($service_name, $_GET);


  		




  48
  52
  
    
			break;


  		




  49
  53
  
    
		case "startservice":


  		




  50
  
  
    
			$savemsg = service_control_start($_GET['service'], $_GET);


  		




  
  54
  
    
			$savemsg = service_control_start($service_name, $_GET);


  		




  51
  55
  
    
			break;


  		




  52
  56
  
    
		case "stopservice":


  		




  53
  
  
    
			$savemsg = service_control_stop($_GET['service'], $_GET);


  		




  
  57
  
    
			$savemsg = service_control_stop($service_name, $_GET);


  		




  54
  58
  
    
			break;


  		




  55
  59
  
    
	}


  		




  56
  60
  
    
	sleep(5);


  		












Formats disponibles :  Unified diff