beenull/raspap-webgui-mirror
1
0
Fork 0
mirror of https://github.com/RaspAP/raspap-webgui.git synced 2024-11-21 23:20:22 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1322 from RaspAP/maint/security

Browse source 
Sanitize hostapd input
This commit is contained in:
Bill Zimmerman 2023-03-29 09:44:17 +02:00 committed by GitHub
commit 238e1670fc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
includes/hostapd.php
View file

@ -99,12 +99,13 @@ function DisplayHostAPDConfig()
}
// set txpower with iw if value is non-default ('auto')
if (isset($_POST['txpower']) && ($_POST['txpower'] != 'auto')) {
$sdBm = $_POST['txpower'] * 100;
exec('sudo /sbin/iw dev '.$_POST['interface'].' set txpower fixed '.$sdBm, $return);
$txpower = intval($_POST['txpower']);
$sdBm = $txpower * 100;
exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower fixed '.$sdBm, $return);
$status->addMessage('Setting transmit power to '.$_POST['txpower'].' dBm.', 'success');
$txpower = $_POST['txpower'];
} elseif ($_POST['txpower'] == 'auto') {
exec('sudo /sbin/iw dev '.$_POST['interface'].' set txpower auto', $return);
exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower auto', $return);
$status->addMessage('Setting transmit power to '.$_POST['txpower'].'.', 'success');
$txpower = $_POST['txpower'];
}