* [PATCH 1/2] mail.cgi: Always check content of fields
@ 2019-10-30 10:58 Michael Tremer
2019-10-30 10:59 ` [PATCH 2/2] mail.cgi: Do not print content of input fields Michael Tremer
0 siblings, 1 reply; 2+ messages in thread
From: Michael Tremer @ 2019-10-30 10:58 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 1114 bytes --]
These checks did not do anything but clear all fields
when mailing was disabled.
It makes a lot more sense to retain people's settings,
even when they have been disabled.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
html/cgi-bin/mail.cgi | 17 ++++-------------
1 file changed, 4 insertions(+), 13 deletions(-)
diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index 9cf14cac8..07986a4d6 100755
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -81,19 +81,10 @@ if ( -f $mailfile){
#ACTIONS
if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite
- #Check fields
- if ($cgiparams{'USEMAIL'} eq 'on'){
- $errormessage=&checkmailsettings;
- }else{
- $cgiparams{'txt_mailserver'}='';
- $cgiparams{'txt_mailport'}='';
- $cgiparams{'txt_mailuser'}='';
- $cgiparams{'txt_mailpass'}='';
- $cgiparams{'mail_tls'}='';
- $cgiparams{'txt_mailsender'}='';
- $cgiparams{'txt_recipient'}='';
- }
- if(!$errormessage){
+ # Check fields
+ $errormessage = &checkmailsettings();
+
+ if (!$errormessage) {
#clear hashes
%auth=();
%dma=();
--
2.20.1
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH 2/2] mail.cgi: Do not print content of input fields
2019-10-30 10:58 [PATCH 1/2] mail.cgi: Always check content of fields Michael Tremer
@ 2019-10-30 10:59 ` Michael Tremer
0 siblings, 0 replies; 2+ messages in thread
From: Michael Tremer @ 2019-10-30 10:59 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 1861 bytes --]
This was printed unescaped and could therefore be used
for a stored XSS attack.
Fixes: #12226
Reported-by: Pisher Honda <pisher24(a)gmail.com>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
html/cgi-bin/mail.cgi | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index 07986a4d6..25589046e 100755
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -260,21 +260,21 @@ sub checkmailsettings {
#Check if mailserver is an ip address or a domain
if ($cgiparams{'txt_mailserver'} =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/){
if (! &General::validip($cgiparams{'txt_mailserver'})){
- $errormessage.="$Lang::tr{'email invalid mailip'} $cgiparams{'txt_mailserver'}<br>";
+ $errormessage .= $Lang::tr{'email invalid mailip'} . "<br>";
}
}elsif(! &General::validfqdn($cgiparams{'txt_mailserver'})){
- $errormessage.="$Lang::tr{'email invalid mailfqdn'} $cgiparams{'txt_mailserver'}<br>";
+ $errormessage .= $Lang::tr{'email invalid mailfqdn'} . "<br>";
}
#Check valid mailserverport
if($cgiparams{'txt_mailport'} < 1 || $cgiparams{'txt_mailport'} > 65535){
- $errormessage.="$Lang::tr{'email invalid mailport'} $cgiparams{'txt_mailport'}<br>";
+ $errormessage .= $Lang::tr{'email invalid mailport'} . "<br>";
}
#Check valid sender
if(! $cgiparams{'txt_mailsender'}){
- $errormessage.="$Lang::tr{'email empty field'} $Lang::tr{'email mailsender'}<br>";
+ $errormessage .= $Lang::tr{'email empty field'} . "<br>";
}else{
if (! &General::validemail($cgiparams{'txt_mailsender'})){
- $errormessage.="<br>$Lang::tr{'email invalid'} $Lang::tr{'email mailsender'}<br>";
+ $errormessage .= "$Lang::tr{'email invalid'} $Lang::tr{'email mailsender'}<br>";
}
}
return $errormessage;
--
2.20.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-30 10:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-30 10:58 [PATCH 1/2] mail.cgi: Always check content of fields Michael Tremer
2019-10-30 10:59 ` [PATCH 2/2] mail.cgi: Do not print content of input fields Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox