mirror of
https://github.com/webmin/webmin.git
synced 2026-02-17 20:22:15 +00:00
b593501cff
All $err type error messages in HTML are safely escaped now.
URL-encoding in links:
I have implemented urlize() in all places where user input ($in{'device'}, $in{'slice'}, $in{'part'}) was included in the URL (footer/redirect/other link), e.g. edit_slice.cgi?device=...&slice=....
Affected files include: create_part.cgi, create_slice.cgi, delete_part.cgi, delete_slice.cgi, change_slice_label.cgi, part_form.cgi, slice_form.cgi, edit_slice.cgi, edit_part.cgi, fsck.cgi, newfs.cgi, newfs_form.cgi, save_part.cgi, save_slice.cgi, save_slice_label.cgi, zfs_create.cgi, zvol_create.cgi.
50 lines
1.6 KiB
Perl
50 lines
1.6 KiB
Perl
#!/usr/local/bin/perl
|
|
# Save slice label (GPT label or glabel)
|
|
|
|
use strict;
|
|
use warnings;
|
|
no warnings 'redefine';
|
|
no warnings 'uninitialized';
|
|
require './bsdfdisk-lib.pl';
|
|
our ( %in, %text, $module_name );
|
|
&ReadParse();
|
|
&error_setup( $text{'slice_label_err'} );
|
|
|
|
# Validate input parameters to prevent command injection
|
|
$in{'device'} =~ /^[a-zA-Z0-9_\/.-]+$/ or &error("Invalid device name");
|
|
$in{'device'} !~ /\.\./ or &error("Invalid device name");
|
|
$in{'slice'} =~ /^\d+$/ or &error("Invalid slice number");
|
|
|
|
my $label = defined $in{'label'} ? $in{'label'} : '';
|
|
$label =~ s/^\s+|\s+$//g;
|
|
$label ne '' || &error( $text{'slice_label_empty'} );
|
|
|
|
# Get the disk and slice
|
|
my @disks = &list_disks_partitions();
|
|
my ($disk) = grep { $_->{'device'} eq $in{'device'} } @disks;
|
|
$disk || &error( $text{'disk_egone'} );
|
|
my ($slice) = grep { $_->{'number'} eq $in{'slice'} } @{ $disk->{'slices'} };
|
|
$slice || &error( $text{'slice_egone'} );
|
|
|
|
# Ensure we can set labels on this scheme
|
|
my $base_device = $disk->{'device'};
|
|
$base_device =~ s{^/dev/}{};
|
|
my $ds = get_disk_structure($base_device);
|
|
if ( !$ds || !$ds->{'scheme'} || $ds->{'scheme'} !~ /GPT/i ) {
|
|
if ( !has_command('glabel') ) {
|
|
&error( $text{'slice_label_noglabel'} );
|
|
}
|
|
}
|
|
|
|
my $err = set_partition_label(
|
|
disk => $disk,
|
|
slice => $slice,
|
|
label => $label,
|
|
);
|
|
&error( &html_escape($err) ) if ($err);
|
|
|
|
&webmin_log( "label", "slice", $slice->{'device'}, { 'label' => $label } );
|
|
my $url_device = &urlize( $in{'device'} );
|
|
my $url_slice = &urlize( $in{'slice'} );
|
|
&redirect("edit_slice.cgi?device=$url_device&slice=$url_slice");
|