From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <development+bounces-1238-archive=lists.ipfire.org@lists.ipfire.org>
Received: from mail02.haj.ipfire.org (localhost [IPv6:::1])
	by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cssTp3JwBz331H
	for <archive@lists.ipfire.org>; Thu, 23 Oct 2025 16:50:22 +0000 (UTC)
Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange x25519)
	(Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK))
	by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cssTl0pKmz2xGG
	for <development@lists.ipfire.org>; Thu, 23 Oct 2025 16:50:19 +0000 (UTC)
Received: from [127.0.0.1] (localhost [127.0.0.1])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mail01.ipfire.org (Postfix) with ESMTPSA id 4cssTL01Ppz3x3;
	Thu, 23 Oct 2025 16:49:57 +0000 (UTC)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org;
	s=202003ed25519; t=1761238198;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references;
	bh=fGm1X66mh/NmjZs1qjFO4F8LXIWkR+94bs6ZfSob+tE=;
	b=XbI0EWHMi5ECrJLaw0yAjgdy9CF7xy3P1lumR/iXoEF8/0KXEpleji42O+c4dT36E/jbnj
	/niH2eowtzVu0JAA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa;
	t=1761238198;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references;
	bh=fGm1X66mh/NmjZs1qjFO4F8LXIWkR+94bs6ZfSob+tE=;
	b=KyddYNQC6EDd5hXwkkxiZjB+9EvRkKtKv2DZX4r22FRSBm/7IsaoLlXyCbHRScbqmqbKoX
	KaEI6XCuYJXcNUTOzInHcnFB18n3wougwrtamcqGBLmsl8TkX3gXVL/URVVJ+IHiG3VPss
	rGNWVa7Lq3z3lzfqpmLOiYh0fz9kOL/VvtpqdVAsXOrXa3OjS5Pllidfut4X51Z7vDW0El
	f36gEWN7UI5bPeu7tN58NCAzqpJWKVWTdgng+eLH8wcHPbYnhMj9BOe/sRynnkbbVcoFJs
	Y3jWT8ujPKwjDVt2an5QPyIn9IKDErdNT8oZSaI4zldcRBmNkzeF1mc5F+cM7Q==
Content-Type: text/plain;
	charset=utf-8
Precedence: list
List-Id: <development.lists.ipfire.org>
List-Subscribe: <https://lists.ipfire.org/>,
 <mailto:development+subscribe@lists.ipfire.org?subject=subscribe>
List-Unsubscribe: <https://lists.ipfire.org/>,
 <mailto:development+unsubscribe@lists.ipfire.org?subject=unsubscribe>
List-Post: <mailto:development@lists.ipfire.org>
List-Help: <mailto:development+help@lists.ipfire.org?subject=help>
Sender: <development@lists.ipfire.org>
Mail-Followup-To: <development@lists.ipfire.org>
Mime-Version: 1.0
Subject: Re: [PATCH] wlanap.cgi: Save IEEE80211W 'optional' value correctly
From: Michael Tremer <michael.tremer@ipfire.org>
In-Reply-To: <bf61cf0ad4ee107a5b1d4997a318cd8a4fac786d.camel@ipfire.org>
Date: Thu, 23 Oct 2025 17:49:57 +0100
Cc: development@lists.ipfire.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <71DBF841-A4E9-45AC-A2E8-35AA1E38966E@ipfire.org>
References: <20251017094258.632108-1-ummeegge@ipfire.org>
 <930F4556-F971-47C7-94A5-A704D30AB220@ipfire.org>
 <bf61cf0ad4ee107a5b1d4997a318cd8a4fac786d.camel@ipfire.org>
To: ummeegge <ummeegge@ipfire.org>

Hello Erik,

Yes, thank you. That looks good to me.

-Michael

> On 22 Oct 2025, at 19:02, ummeegge <ummeegge@ipfire.org> wrote:
>=20
> Hi Michael,
> hope version 2 fits the needs.
>=20
> Best,
>=20
> Erik
>=20
> Am Mittwoch, dem 22.10.2025 um 11:17 +0100 schrieb Michael Tremer:
>> Hello Erik,
>>=20
>> Thank you for your patch.
>>=20
>> I cannot quite merge this because the patch changes behaviour so that
>> the browser could write arbitrary values into the configuration file
>> without further sanitisation. To fix this, we must check if
>> $cgiparams{'IEEE80211W=E2=80=99} contains one of three possible =
values.
>>=20
>> Would you like to update this patch accordingly?
>>=20
>> -Michael
>>=20
>>> On 17 Oct 2025, at 10:42, ummeegge <ummeegge@ipfire.org> wrote:
>>>=20
>>> Original ternary ignored 'optional' and forced 'off'.
>>> Use defined-or (//) to preserve all select values.
>>>=20
>>> Signed-off-by: ummeegge <ummeegge@ipfire.org>
>>> ---
>>> html/cgi-bin/wlanap.cgi | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>=20
>>> diff --git a/html/cgi-bin/wlanap.cgi b/html/cgi-bin/wlanap.cgi
>>> index 600ddc489..afdba59b3 100644
>>> --- a/html/cgi-bin/wlanap.cgi
>>> +++ b/html/cgi-bin/wlanap.cgi
>>> @@ -118,7 +118,7 @@ if ($cgiparams{'ACTION'} eq
>>> "$Lang::tr{'save'}") {
>>> $wlanapsettings{'NOSCAN'} =3D ($cgiparams{'NOSCAN'} eq 'on') ? 'on' =
:
>>> 'off';
>>> $wlanapsettings{'ENC'} =3D $cgiparams{'ENC'};
>>> $wlanapsettings{'PWD'} =3D $cgiparams{'PWD'};
>>> - $wlanapsettings{'IEEE80211W'} =3D ($cgiparams{'IEEE80211W'} eq
>>> 'on') ? 'on' : 'off';
>>> + $wlanapsettings{'IEEE80211W'} =3D $cgiparams{'IEEE80211W'} //
>>> 'off';
>>> $wlanapsettings{'TX_POWER'} =3D $cgiparams{'TX_POWER'};
>>>=20
>>> if ($errormessage eq '') {
>>> --=20
>>> 2.47.2
>>>=20
>>>=20
>=20