mirror of
https://github.com/pi-hole/web.git
synced 2026-05-01 22:24:08 +01:00
Fix security issue when using list functionality via api.php
Remote code execution could have been triggered by activating some list functionality (add and remove) via api.php. Thanks to Kacper Szurek for finding this bug. Signed-off-by: Mcat12 <newtoncat12@yahoo.com>
This commit is contained in:
@@ -142,14 +142,5 @@ function list_verify($type) {
|
||||
{
|
||||
log_and_die("Not allowed!");
|
||||
}
|
||||
|
||||
// Don't check if the added item is a
|
||||
// valid domain for regex expressions
|
||||
// Regex filters are validated by FTL
|
||||
// on import and skipped if invalid
|
||||
if($_POST['list'] !== "regex")
|
||||
{
|
||||
check_domain();
|
||||
}
|
||||
}
|
||||
?>
|
||||
|
||||
Reference in New Issue
Block a user