[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5fff4e12e51746d65e5ee3621e0a81d471910265

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5fff4e12e51746d65e5ee3621e0a81d471910265

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  5fff4e12e51746d65e5ee3621e0a81d471910265 (commit)
      from  2e83b68048f94e3f623c02425e54808895e3313f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5fff4e12e51746d65e5ee3621e0a81d471910265
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Oct 27 15:23:03 2025 +0000

    calamaris.dat: Move the check before adding shell redirection
    
    Fixes: #13886 - /cgi-bin/logs.cgi/calamaris.dat Multiple Parameters Command Injection
    Reported-by: Wade Sparks <wsparks@vulncheck.com>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 html/cgi-bin/logs.cgi/calamaris.dat | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Difference in files:
diff --git a/html/cgi-bin/logs.cgi/calamaris.dat b/html/cgi-bin/logs.cgi/calamaris.dat
index 1c8e4b68e..f0ed1c265 100644
--- a/html/cgi-bin/logs.cgi/calamaris.dat
+++ b/html/cgi-bin/logs.cgi/calamaris.dat
@@ -166,14 +166,15 @@ if ($reportsettings{'ACTION'} eq $Lang::tr{'calamaris create report'})
 		$commandline.=' -s';
 	}
 
-	$commandline.=' < /dev/null > /dev/null 2>&1';
-
-	if ($reportsettings{'RUN_BACKGROUND'} eq 'on') { $commandline.=" &"; }
-
 	if (!($commandline =~ /^[a-zA-Z0-9-\s]+$/))
 	{
 		die "Invalid input in\"$commandline\"";
 	}
+
+	$commandline.=' < /dev/null > /dev/null 2>&1';
+
+	if ($reportsettings{'RUN_BACKGROUND'} eq 'on') { $commandline.=" &"; }
+
 	system("${General::swroot}/proxy/calamaris/bin/mkreport $commandline")
 }
 


hooks/post-receive
--
IPFire 2.x development tree