Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-base: fix possible shell injection in luci.tools.status.switch_status()

Browse source 
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2018-04-05 00:32:28 +02:00
parent 186e690c08
commit 9db5fa93af
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/luci-base/luasrc/tools/status.lua
View file

@ -187,7 +187,7 @@ function switch_status(devs)
local switches = { } local switches = { }
for dev in devs:gmatch("[^%s,]+") do for dev in devs:gmatch("[^%s,]+") do
local ports = { } local ports = { }
local swc = io.popen("swconfig dev %q show" % dev, "r") local swc = io.popen("swconfig dev '%s' show" % dev:gsub("'", ""), "r")
if swc then if swc then
local l local l
repeat repeat