Projet

Général

Profil

« Précédent | Suivant » 

Révision 4cc34245

Ajouté par Renato Botelho il y a presque 10 ans

Add some protection to parameters that come through _GET

Voir les différences:

etc/inc/service-utils.inc
515 515 
			services_radvd_configure();
516 516 
			break;
517 517 
		case 'captiveportal':
518 
			$zone = $extras['zone'];
518 
			$zone = htmlspecialchars($extras['zone']);
519 519 
			captiveportal_init_webgui_zonename($zone);
520 520 
			break;
521 521 
		case 'ntpd':
......
550 550 
			vpn_ipsec_force_reload();
551 551 
			break;
552 552 
		case 'openvpn':
553 
			$vpnmode = isset($extras['vpnmode']) ? $extras['vpnmode'] : $extras['mode'];
553 
			$vpnmode = isset($extras['vpnmode']) ? htmlspecialchars($extras['vpnmode']) : htmlspecialchars($extras['mode']);
554 554 
			if (($vpnmode == "server") || ($vpnmode == "client")) {
555 
				$id = isset($extras['vpnid']) ? $extras['vpnid'] : $extras['id'];
555 
				$id = isset($extras['vpnid']) ? htmlspecialchars($extras['vpnid']) : htmlspecialchars($extras['id']);
556 556 
				$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
557 557 
				if (file_exists($configfile))
558 558 
					openvpn_restart_by_vpnid($vpnmode, $id);
......
574 574 
			killbypid("{$g['varrun_path']}/radvd.pid");
575 575 
			break;
576 576 
		case 'captiveportal':
577 
			$zone = $extras['zone'];
577 
			$zone = htmlspecialchars($extras['zone']);
578 578 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
579 579 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
580 580 
			break;
......
618 618 
			exec("killall -9 racoon");
619 619 
			break;
620 620 
		case 'openvpn':
621 
			$vpnmode = $extras['vpnmode'];
621 
			$vpnmode = htmlspecialchars($extras['vpnmode']);
622 622 
			if (($vpnmode == "server") or ($vpnmode == "client")) {
623 
				$id = $extras['id'];
623 
				$id = htmlspecialchars($extras['id']);
624 624 
				$pidfile = "{$g['varrun_path']}/openvpn_{$vpnmode}{$id}.pid";
625 625 
				killbypid($pidfile);
626 626 
			}
......
641 641 
			services_radvd_configure();
642 642 
			break;
643 643 
		case 'captiveportal':
644 
			$zone = $extras['zone'];
644 
			$zone = htmlspecialchars($extras['zone']);
645 645 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal.pid");
646 646 
			killbypid("{$g['varrun_path']}/lighty-{$zone}-CaptivePortal-SSL.pid");
647 647 
			captiveportal_init_webgui_zonename($zone);
......
679 679 
			vpn_ipsec_force_reload();
680 680 
			break;
681 681 
		case 'openvpn':
682 
			$vpnmode = $extras['vpnmode'];
682 
			$vpnmode = htmlspecialchars($extras['vpnmode']);
683 683 
			if ($vpnmode == "server" || $vpnmode == "client") {
684 
				$id = $extras['id'];
684 
				$id = htmlspecialchars($extras['id']);
685 685 
				$configfile = "{$g['varetc_path']}/openvpn/{$vpnmode}{$id}.conf";
686 686 
				if (file_exists($configfile))
687 687 
					openvpn_restart_by_vpnid($vpnmode, $id);
usr/local/www/status_services.php
41 41 
require_once("service-utils.inc");
42 42 
require_once("shortcuts.inc");
43 43 

  		




  44
  
  
    
if (!empty($_GET['service'])) {


  		




  
  44
  
    
$service_name = '';


  		




  
  45
  
    
if (isset($_GET['service']))


  		




  
  46
  
    
	$service_name = htmlspecialchars($_GET['service']);


  		




  
  47
  
    

  		




  
  48
  
    
if (!empty($service_name)) {


  		




  45
  49
  
    
	switch ($_GET['mode']) {


  		




  46
  50
  
    
		case "restartservice":


  		




  47
  
  
    
			$savemsg = service_control_restart($_GET['service'], $_GET);


  		




  
  51
  
    
			$savemsg = service_control_restart($service_name, $_GET);


  		




  48
  52
  
    
			break;


  		




  49
  53
  
    
		case "startservice":


  		




  50
  
  
    
			$savemsg = service_control_start($_GET['service'], $_GET);


  		




  
  54
  
    
			$savemsg = service_control_start($service_name, $_GET);


  		




  51
  55
  
    
			break;


  		




  52
  56
  
    
		case "stopservice":


  		




  53
  
  
    
			$savemsg = service_control_stop($_GET['service'], $_GET);


  		




  
  57
  
    
			$savemsg = service_control_stop($service_name, $_GET);


  		




  54
  58
  
    
			break;


  		




  55
  59
  
    
	}


  		




  56
  60
  
    
	sleep(5);


  		












Formats disponibles :  Unified diff