michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-10-20 11:10:40 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Fix server login and logout cookie validation to be numeric
Some checks failed
Tests / prove (push) Has been cancelled
Details
Package and upload artifacts / build (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Ilia Ross
2026-10-19 15:58:59 +02:00
parent aa82e2ebd5
commit dfce125874
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
servers/login.cgi
View File

@@ -11,6 +11,7 @@ our (%in);
&ReadParse();
my $enc = &encode_base64($in{'user'}.":".$in{'pass'});
$in{'id'} =~ s/\r|\n|\0//g;
$in{'id'} =~ /\A[0-9]+\z/ || &error("Invalid server ID");
$enc =~ s/\r|\n|\0//g;
print "Set-Cookie: $in{'id'}=$enc; path=/";
if (uc($ENV{'HTTPS'}) eq 'ON') {

1
servers/logout.cgi
View File

@@ -10,6 +10,7 @@ require './servers-lib.pl';
&ReadParse();
our (%in);
$in{'id'} =~ s/\r|\n|\0//g;
$in{'id'} =~ /\A[0-9]+\z/ || &error("Invalid server ID");
print "Set-Cookie: $in{'id'}=; path=/";
if (uc($ENV{'HTTPS'}) eq 'ON') {
print "; secure";