Pi-Hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2026-04-27 12:15:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use htmlentities() to mitigate XSS (this function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities)

Browse Source 
Signed-off-by: DL6ER <dl6er@dl6er.de>
This commit is contained in:
DL6ER
2017-10-06 23:47:06 +02:00
parent a50525d72b
commit d1d9d7faff
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/pi-hole/php/teleporter.php
View File

@@ -107,13 +107,13 @@ if(isset($_POST["action"]))
$continue = strtolower($name[1]) == 'tar' && strtolower($name[2]) == 'gz' ? true : false;
if(!$continue || !$okay) {
die("The file you are trying to upload is not a .tar.gz file (filename: ".htmlspecialchars($filename).", type: ".htmlspecialchars($type)."). Please try again.");
die("The file you are trying to upload is not a .tar.gz file (filename: ".htmlentities($filename).", type: ".htmlentities($type)."). Please try again.");
}
$fullfilename = sys_get_temp_dir().$filename;
if(!move_uploaded_file($_FILES["zip_file"]["tmp_name"], $fullfilename))
if(!move_uploaded_file($source, $fullfilename))
{
die("Failed moving ".$_FILES["zip_file"]["tmp_name"]." to ".$fullfilename);
die("Failed moving ".htmlentities($source)." to ".htmlentities($fullfilename));
}
$archive = new PharData($fullfilename);
@@ -157,7 +157,7 @@ else
$archive = new PharData($archive_file_name);
if ($archive->isWritable() !== TRUE) {
exit("cannot open/create $archive_file_name<br>PHP user: ".exec('whoami')."\n");
exit("cannot open/create ".htmlentities($archive_file_name)".<br>\nPHP user: ".exec('whoami')."\n");
}
archive_add_file("/etc/pihole/","whitelist.txt");