psychon 21120e2146 Handle newlines in CHTTPSock::GetParam() and strip them out. ...

There was a bug in webadmin which allowed any users to write arbitrary strings
to znc.conf by setting e.g. their quit message to:
  Some quit message
  Admin = true
  LoadModule = shell
  </User>
  ISpoofFile = /home/<user>/.ssh/authorited_keys
  ISpoofFormat = <some ssh key>
  <User a>
(The newlines must be sent as newlines to webadmin)

This commit fixes this by stripping all newlines from all the data fields
by default. Since some fields (e.g. CTCPReplies and Servers) do need newlines,
there is a new function CHTTPSock::GetRawParam() which doesn't do the stripping.

Thanks to cnu for finding and reporting this bug.
Thanks to kroimon for patch review.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1395 726aef4b-f618-498e-8847-2d620e286838

2009-02-24 16:00:11 +00:00

32 KiB

Raw Blame History

View Raw