dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More secure skin param check (#1346)

Browse Source
This commit is contained in:
Xavier Guimard 2017-12-20 22:52:52 +01:00
parent 35d7e7e2f5
commit 931188b15f
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Main/Display.pm
View File

@ -421,14 +421,20 @@ sub getSkin {
# Check skin GET/POST parameter # Check skin GET/POST parameter
my $skinParam = $req->param('skin'); my $skinParam = $req->param('skin');
if ( defined $skinParam and !$self->checkXSSAttack( 'skin', $skinParam ) ) { if ( defined $skinParam ) {
if ( -d $self->conf->{templateDir} . '/' . $skinParam ) { if ( $skinParam =~ /^[\w\-]$/ ) {
$skin = $skinParam; if ( -d $self->conf->{templateDir} . '/' . $skinParam ) {
$self->logger->debug("Skin $skin selected from GET/POST parameter"); $skin = $skinParam;
$self->logger->debug(
"Skin $skin selected from GET/POST parameter");
}
else {
$self->userLogger->error(
"User tries to access to unexistent skin dir $skinParam");
}
} }
else { else {
$self->userLogger->error( $self->userLogger->error("Strange skin parameter: $skinParam");
"User tries to access to unexistent skin dir $skinParam");
} }
} }