Mascali/raspisms
1
0
Fork 0
mirror of https://github.com/RaspbianFrance/raspisms.git synced 2025-04-20 16:37:48 +02:00
Code Issues Projects Releases Wiki Activity

Fix command bash injection using filename + add constant to disable commands

Browse source
This commit is contained in:
osaajani 2020-06-17 19:08:11 +02:00
parent 3839742f58
commit 39caa92a62
3 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
controllers/internals/Command.php
View file

@ -78,6 +78,11 @@ namespace controllers\internals;
*/
public function analyze_and_process (int $id_user, string $message)
{
if (!ENABLE_COMMAND)
{
return false;
}
$extracted_command = [];
$decode_message = json_decode(trim($message), true);
@ -127,7 +132,13 @@ namespace controllers\internals;
$decode_message['password'] = '******';
$updated_text = json_encode($decode_message);
$generated_command = PWD_SCRIPTS . '/' . $find_command['script'];
$script = $find_command['script'];
while (str_replace('..', '', $script) !== $script)
{
$script = str_replace('..', '', $script);
}
$generated_command = PWD_SCRIPTS . '/' . escapeshellarg($script);
$args = $decode_message['args'] ?? '';
$generated_command .= ' ' . escapeshellcmd($args);