From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 2/2] mail.cgi: Do not print content of input fields
Date: Wed, 30 Oct 2019 10:59:00 +0000
Message-ID: <20191030105900.15306-2-michael.tremer@ipfire.org>
In-Reply-To: <20191030105900.15306-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8051958307254403381=="
List-Id: <development.lists.ipfire.org>

--===============8051958307254403381==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This was printed unescaped and could therefore be used
for a stored XSS attack.

Fixes: #12226
Reported-by: Pisher Honda <pisher24(a)gmail.com>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 html/cgi-bin/mail.cgi | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index 07986a4d6..25589046e 100755
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -260,21 +260,21 @@ sub checkmailsettings {
 	#Check if mailserver is an ip address or a domain
 	if ($cgiparams{'txt_mailserver'} =3D~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/){
 		if (! &General::validip($cgiparams{'txt_mailserver'})){
-			$errormessage.=3D"$Lang::tr{'email invalid mailip'} $cgiparams{'txt_mails=
erver'}<br>";
+			$errormessage .=3D $Lang::tr{'email invalid mailip'} . "<br>";
 		}
 	}elsif(! &General::validfqdn($cgiparams{'txt_mailserver'})){
-			$errormessage.=3D"$Lang::tr{'email invalid mailfqdn'} $cgiparams{'txt_mai=
lserver'}<br>";
+			$errormessage .=3D $Lang::tr{'email invalid mailfqdn'} . "<br>";
 	}
 	#Check valid mailserverport
 	if($cgiparams{'txt_mailport'} < 1 || $cgiparams{'txt_mailport'} > 65535){
-		$errormessage.=3D"$Lang::tr{'email invalid mailport'} $cgiparams{'txt_mail=
port'}<br>";
+		$errormessage .=3D $Lang::tr{'email invalid mailport'} . "<br>";
 	}
 	#Check valid sender
 	if(! $cgiparams{'txt_mailsender'}){
-		$errormessage.=3D"$Lang::tr{'email empty field'} $Lang::tr{'email mailsend=
er'}<br>";
+		$errormessage .=3D $Lang::tr{'email empty field'} . "<br>";
 	}else{
 		if (! &General::validemail($cgiparams{'txt_mailsender'})){
-			$errormessage.=3D"<br>$Lang::tr{'email invalid'} $Lang::tr{'email mailsen=
der'}<br>";
+			$errormessage .=3D "$Lang::tr{'email invalid'} $Lang::tr{'email mailsende=
r'}<br>";
 		}
 	}
 	return $errormessage;
--=20
2.20.1


--===============8051958307254403381==--