beenull/raspap-webgui-mirror
1
0
Fork 0
mirror of https://github.com/RaspAP/raspap-webgui.git synced 2024-11-22 07:30:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1322 from RaspAP/maint/security

Browse source 
Sanitize hostapd input
This commit is contained in:
Bill Zimmerman 2023-03-29 09:44:17 +02:00 committed by GitHub
commit 238e1670fc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
includes/hostapd.php
View file

@ -99,12 +99,13 @@ function DisplayHostAPDConfig()
} }
// set txpower with iw if value is non-default ('auto') // set txpower with iw if value is non-default ('auto')
if (isset($_POST['txpower']) && ($_POST['txpower'] != 'auto')) { if (isset($_POST['txpower']) && ($_POST['txpower'] != 'auto')) {
$sdBm = $_POST['txpower'] * 100; $txpower = intval($_POST['txpower']);
exec('sudo /sbin/iw dev '.$_POST['interface'].' set txpower fixed '.$sdBm, $return); $sdBm = $txpower * 100;
exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower fixed '.$sdBm, $return);
$status->addMessage('Setting transmit power to '.$_POST['txpower'].' dBm.', 'success'); $status->addMessage('Setting transmit power to '.$_POST['txpower'].' dBm.', 'success');
$txpower = $_POST['txpower']; $txpower = $_POST['txpower'];
} elseif ($_POST['txpower'] == 'auto') { } elseif ($_POST['txpower'] == 'auto') {
exec('sudo /sbin/iw dev '.$_POST['interface'].' set txpower auto', $return); exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower auto', $return);
$status->addMessage('Setting transmit power to '.$_POST['txpower'].'.', 'success'); $status->addMessage('Setting transmit power to '.$_POST['txpower'].'.', 'success');
$txpower = $_POST['txpower']; $txpower = $_POST['txpower'];
} }