External-Mirrors/nextcloudpi
2
0
Fork 0
mirror of https://github.com/nextcloud/nextcloudpi.git synced 2026-01-10 15:12:01 -03:30
Code Issues Packages Projects Releases Wiki Activity

ncp-web: avoid quotes in fields

Browse Source 
Signed-off-by: nachoparker <nacho@ownyourbits.com>
This commit is contained in:
nachoparker 2019-06-01 15:43:09 -06:00
parent 86f14ae2a7
commit 5de855ffec
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changelog.md
View File

@ -1,5 +1,7 @@
[v1.13.0](https://github.com/nextcloud/nextcloudpi/commit/4572d74) (2019-06-01) upgrade to NC15.0.8
[v1.13.1](https://github.com/nextcloud/nextcloudpi/commit/18172be) (2019-06-01) ncp-web: avoid quotes in fields
[v1.13.0](https://github.com/nextcloud/nextcloudpi/commit/86f14ae) (2019-06-01) upgrade to NC15.0.8
[v1.12.10](https://github.com/nextcloud/nextcloudpi/commit/5924131) (2019-06-01) fail2ban: fix missing ufw filter

2
etc/library.sh
View File

@ -62,7 +62,7 @@ function configure_app()
for (( i = 0 ; i < len ; i++ )); do
# check for invalid characters
grep -q '[\\&#;`|*?~<>^()[{}$&[:space:]]' <<< "${ret_vals[$i]}" && { echo "Invalid characters in field ${vars[$i]}"; return 1; }
grep -q '[\\&#;'"'"'`|*?~<>^"()[{}$&[:space:]]' <<< "${ret_vals[$i]}" && { echo "Invalid characters in field ${vars[$i]}"; return 1; }
cfg="$(jq ".params[$i].value = \"${ret_vals[$i]}\"" <<<"$cfg")"
done

2
ncp-web/ncp-launcher.php
View File

@ -66,7 +66,7 @@ if ( $_POST['action'] == "launch" && $_POST['config'] )
// sanitize
$val = trim(escapeshellarg($new_params[$id]),"'");
preg_match( '/ /' , $val , $matches )
preg_match( '/[\'" ]/' , $val , $matches )
and exit( '{ "output": "Invalid parameters" , "token": "' . getCSRFToken() . '" }' );
// save