michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-02-03 06:03:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix to do a bit more filtering to prevent root user XSS itself

Browse Source
This commit is contained in:
iliajie
2023-08-02 23:31:59 +03:00
parent 02a5982ff9
commit 054f0a254e
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ui-lib.pl
View File

@@ -996,13 +996,13 @@ foreach $o (@$opts) {
$o = [ $o ] if (!ref($o));
$rv .= "<option value=\"".&quote_escape($o->[0])."\"".
($sel{$o->[0]} ? " selected" : "").($o->[2] ne '' ? " ".$o->[2] : "").">".
($o->[1] || $o->[0])."</option>\n";
&filter_javascript($o->[1] || $o->[0])."</option>\n";
$opt{$o->[0]}++;
}
foreach $s (keys %sel) {
if (!$opt{$s} && $missing) {
$rv .= "<option value=\"".&quote_escape($s)."\"".
" selected>".($s eq "" ? "&nbsp;" : $s)."</option>\n";
" selected>".($s eq "" ? "&nbsp;" : &filter_javascript($s))."</option>\n";
}
}
$rv .= "</select>\n";

3
usermin/clone_mod.cgi
View File

@@ -7,6 +7,9 @@ require './usermin-lib.pl';
&error_setup($text{'clone_err'});
$access{'umods'} || &error($text{'acl_ecannot'});
# Filter out potentially dangerous strings
$in{'desc'} = &filter_javascript($in{'desc'});
# Symlink the code directory
&get_usermin_miniserv_config(\%miniserv);
$src = $in{'mod'};

3
webmin/clone_mod.cgi
View File

@@ -6,6 +6,9 @@ require './webmin-lib.pl';
&ReadParse();
&error_setup($text{'clone_err'});
# Filter out potentially dangerous strings
$in{'desc'} = &filter_javascript($in{'desc'});
# Symlink the code directory
$src = $in{'mod'};
%minfo = &get_module_info($src);