External-Mirrors/nextcloudpi
2
0
Fork 0
mirror of https://github.com/nextcloud/nextcloudpi.git synced 2026-01-10 15:12:01 -03:30
Code Issues Packages Projects Releases Wiki Activity

sanitize params

Browse Source
This commit is contained in:
nachoparker 2019-01-04 15:22:56 -07:00
parent 7dd4828938
commit c842e00399
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/ncp-config
View File

@ -96,7 +96,7 @@ function config_menu()
# launch selected ncp_app
info_app "$ncp_app" || continue
configure_app "$ncp_app" || continue
configure_app "$ncp_app" && \
run_app "$ncp_app"
echo "Done. Press any key..."
read -r

2
etc/library.sh
View File

@ -61,7 +61,7 @@ function configure_app()
for (( i = 0 ; i < len ; i++ )); do
# check for invalid characters
grep -q "[;&[:space:]]" <<< "${ret_vals[$i]}" && { echo "Invalid characters in field ${vars[$i]}"; break; }
grep -q '[\\&#;`|*?~<>^()[{}$&[:space:]]' <<< "${ret_vals[$i]}" && { echo "Invalid characters in field ${vars[$i]}"; return 1; }
cfg="$(jq ".params[$i].value = \"${ret_vals[$i]}\"" <<<"$cfg")"
done

10
ncp-web/ncp-launcher.php
View File

@ -58,7 +58,15 @@ if ( $_POST['action'] == "launch" && $_POST['config'] )
or exit('{ "output": "Invalid request" }');
foreach ($cfg['params'] as $index => $param)
$cfg['params'][$index]['value'] = $new_params[$cfg['params'][$index]['id']];
{
// sanitize
$val = trim(escapeshellarg($new_params[$cfg['params'][$index]['id']]),"'");
preg_match( '/ /' , $val , $matches )
and exit( '{ "output": "Invalid parameters" , "token": "' . getCSRFToken() . '" }' );
// save
$cfg['params'][$index]['value'] = $val;
}
$cfg_str = json_encode($cfg)
or exit('{ "output": "' . $ncp_app . ' internal error" }');