LX3JL/xlxd
1
0
Fork 0
mirror of https://github.com/LX3JL/xlxd.git synced 2025-12-06 07:42:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

XSS Vulnerability Patches and Security Enhancements for Dashboard1 - Fix parsing error

Browse source
This commit is contained in:
Andy Taylor 2025-10-14 14:35:59 +01:00
parent ee3f5de1de
commit e11754a4e0
3 changed files with 6 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
dashboard/pgs/class.node.php
View file

@ -44,7 +44,7 @@ class Node {
// Validate callsign format (basic check) // Validate callsign format (basic check)
if (!preg_match('/^[A-Z0-9]{1,10}$/i', $this->Callsign)) { if (!preg_match('/^[A-Z0-9]{1,10}$/i', $this->Callsign)) {
$this->Callsign = 'INVALID'; $this->Callsign = 'INVALID';
} }
// Validate LinkedModule (single letter A-Z) // Validate LinkedModule (single letter A-Z)

4
dashboard/pgs/class.parsexml.php
View file

@ -15,8 +15,8 @@ class ParseXML {
$Element = substr($InputString, strpos($InputString, "<".$ElementName.">")+strlen($ElementName)+2, strpos($InputString, "</".$ElementName.">")-strpos($InputString, "<".$ElementName.">")-strlen($ElementName)-2); $Element = substr($InputString, strpos($InputString, "<".$ElementName.">")+strlen($ElementName)+2, strpos($InputString, "</".$ElementName.">")-strpos($InputString, "<".$ElementName.">")-strlen($ElementName)-2);
// Strip any remaining HTML/XML tags from the content // Return raw content - sanitization happens at output time
return strip_tags($Element); return $Element;
} }
public function GetAllElements($InputString, $ElementName) { public function GetAllElements($InputString, $ElementName) {

10
dashboard/pgs/config.inc.php
View file

@ -77,14 +77,8 @@ $VNStat['Binary'] = '/usr/bin/vnstat';
include an extra config file for people who dont like to mess with shipped config.ing.php include an extra config file for people who dont like to mess with shipped config.ing.php
this makes updating dashboard from git a little bit easier this makes updating dashboard from git a little bit easier
*/ */
if (file_exists("../config.inc.php")) {
$external_config = dirname(__FILE__) . '/../config.inc.php'; include ("../config.inc.php");
if (file_exists($external_config)) {
$realPath = realpath($external_config);
// Only allow if it's in parent directory
if ($realPath !== false && dirname($realPath) === dirname(dirname(__FILE__))) {
include($realPath);
}
} }
?> ?>