Files
webmin/fetchmail/stop.cgi
Ilia Ross ac9456b368 Fix to use quotemeta to prevent shell injection in fetchmail module
Ref.: 50a2460d-441a-4bc6 (VULN-003)
2026-02-10 14:45:20 +02:00

32 lines
796 B
Perl
Executable File

#!/usr/local/bin/perl
# stop.cgi
# Stop the running fetchmail daemon
require './fetchmail-lib.pl';
&ReadParse();
&error_setup($text{'stop_err'});
$config{'config_file'} || $< || &error($text{'stop_ecannot'});
$can_daemon || &error($text{'start_ecannot'});
if ($config{'stop_cmd'}) {
$out = &backquote_logged("$config{'stop_cmd'} 2>&1");
}
elsif ($< == 0) {
if ($config{'daemon_user'} eq 'root') {
$out = &backquote_logged("$config{'fetchmail_path'} -q 2>&1");
}
else {
my $qdaemon_user = quotemeta($config{'daemon_user'});
$out = &backquote_logged("su - $qdaemon_user -c ".quotemeta("$config{'fetchmail_path'} -q")." 2>&1");
}
}
else {
$out = &backquote_logged("$config{'fetchmail_path'} -q 2>&1");
}
if ($?) {
&error("<tt>$out</tt>");
}
&webmin_log("stop");
&redirect("");