malhuda/AS-Stats
1
0
Fork 0
mirror of https://github.com/manuelkasper/AS-Stats.git synced 2025-02-20 11:44:12 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix security issue

Browse Source 
'v' parameter of gengraph.php allowed shell command injection.
Reported by Stefan Hanrath.
This commit is contained in:
Manuel Kasper 2013-12-06 09:07:46 +01:00
parent d7b806349c
commit afe5f582d1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
www/gengraph.php
View File

@ -30,7 +30,7 @@ $cmd = "$rrdtool graph - " .
"--slope-mode --alt-autoscale -u 0 -l 0 --imgformat=PNG --base=1000 --height=$height --width=$width " .
"--color BACK#ffffff00 --color SHADEA#ffffff00 --color SHADEB#ffffff00 ";
if (@$_GET['v'])
if (isset($_GET['v']) && is_numeric($_GET['v']))
$cmd .= "--title IPv" . $_GET['v'] . " ";
if (isset($_GET['nolegend']))