mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-03-26 09:42:42 -04:00
7592fd933c
Add input validation and shell argument escaping to prevent OS command injection via the 'show' parameter in web/views/image.php. The parameter is now validated against an allowlist and all values passed to exec() are wrapped with escapeshellarg(). Also fix PHP operator precedence bug in shutdown.php where 'and' was used instead of '&&', causing the 'when' parameter validation to not work as intended. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
57 lines
1.9 KiB
PHP
57 lines
1.9 KiB
PHP
<?php
|
|
//
|
|
// ZoneMinder web action file
|
|
// Copyright (C) 2019 ZoneMinder LLC
|
|
//
|
|
// This program is free software; you can redistribute it and/or
|
|
// modify it under the terms of the GNU General Public License
|
|
// as published by the Free Software Foundation; either version 2
|
|
// of the License, or (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program; if not, write to the Free Software
|
|
// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
//
|
|
|
|
$message = '';
|
|
if ( !canEdit('System') ) {
|
|
$message = 'Need System permissions to shutdown server';
|
|
} else if ( !isset($_REQUEST['command']) ) {
|
|
$message = 'A command is required. Cannot continue';
|
|
}
|
|
|
|
if ( $message ) {
|
|
ZM\Warning($message);
|
|
ajaxError($message);
|
|
return;
|
|
}
|
|
|
|
$data = array();
|
|
// Use strict allowlist for 'when' parameter to prevent command injection
|
|
$when = (isset($_REQUEST['when']) && $_REQUEST['when'] === 'now') ? 'now' : '+1';
|
|
$command = $_REQUEST['command'];
|
|
|
|
if ( $command == 'shutdown' ) {
|
|
exec('sudo -n '.ZM_PATH_SHUTDOWN." -P $when 2>&1", $data['output'], $data['rc']);
|
|
ZM\Debug('Shutdown output ' .$data['rc'].' '.implode("\n",$data['output']));
|
|
} else if ( $command == 'restart' ) {
|
|
$data['output'] = array();
|
|
exec('sudo -n '.ZM_PATH_SHUTDOWN." -r $when 2>&1", $data['output'], $data['rc']);
|
|
ZM\Debug("Shutdown output " . implode("\n",$data['output']));
|
|
} else if ( $command == 'cancel' ) {
|
|
$data['output'] = array();
|
|
exec('sudo '.ZM_PATH_SHUTDOWN.' -c 2>&1', $data['output'], $data['rc']);
|
|
} else {
|
|
ajaxError('Unknwn command:'.$command);
|
|
return;
|
|
}
|
|
|
|
ajaxResponse($data);
|
|
return;
|
|
?>
|