michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-03-11 05:12:03 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix Solaris format module option and device command injection (#10)

Browse Source
This commit is contained in:
Ilia Ross
2026-03-10 17:29:17 +02:00
parent 098544473f
commit 2de16faafc
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
format/fsck.cgi
View File

@@ -7,8 +7,9 @@ $access{'view'} && &error($text{'ecannot'});
&ReadParse();
&can_edit_disk($in{'dev'}) || &error($text{'fsck_ecannot'});
&ui_print_header(undef, $text{'fsck_title'}, "");
$in{'mode'} =~ /^-(m|n|y)$/ || &error($text{'fsck_ecannot'});
$in{dev} =~ s/dsk/rdsk/g;
$cmd = "fsck -F ufs $in{mode} $in{dev}";
$cmd = "fsck -F ufs $in{mode} ".quotemeta($in{dev});
print &text('fsck_exec', "<tt>$cmd</tt>"),"<p>\n";
print "<pre>\n";

4
format/newfs.cgi
View File

@@ -16,13 +16,15 @@ $cmd .= &opt_check("ufs_f", '\d+', "-f");
$cmd .= &opt_check("ufs_i", '\d+', "-i");
$cmd .= &opt_check("ufs_m", '\d+', "-m");
$cmd .= &opt_check("ufs_n", '\d+', "-n");
$in{ufs_o} =~ /^(space|time)$/ || !$in{ufs_o} ||
&error($text{'newfs_ecannot'});
$cmd .= $in{ufs_o} ? " -o $in{ufs_o}" : "";
$cmd .= &opt_check("ufs_r", '\d+', "-r");
$cmd .= &opt_check("ufs_s", '\d+', "-s");
$cmd .= &opt_check("ufs_t", '\d+', "-t");
$cmd .= &opt_check("ufs_cb", '\d+', "-C");
$in{dev} =~ s/dsk/rdsk/g;
$cmd .= " $in{dev}";
$cmd .= " ".quotemeta($in{dev});
&ui_print_header(undef, $text{'newfs_title'}, "");

4
format/tunefs.cgi
View File

@@ -13,9 +13,11 @@ $cmd .= &opt_check("tunefs_a", '\d+', "-a");
$cmd .= &opt_check("tunefs_d", '\d+', "-d");
$cmd .= &opt_check("tunefs_e", '\d+', "-e");
$cmd .= &opt_check("tunefs_m", '\d+', "-m");
$in{tunefs_o} =~ /^(space|time)$/ || !$in{tunefs_o} ||
&error($text{'tunefs_ecannot'});
$cmd .= $in{tunefs_o} ? " -o $in{tunefs_o}" : "";
$in{dev} =~ s/dsk/rdsk/g;
$cmd .= " $in{dev}";
$cmd .= " ".quotemeta($in{dev});
&ui_print_header(undef, $text{'tunefs_title'}, "");