FIX #3: CVE-2014-3926: XSS in <title> via "addr" parameter

This code is from 04adc9d
Cougar · Jun 22, 2014 · 12339bf · 12339bf
1 parent a686dc8
commit 12339bf
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lg.cgi b/lg.cgi
@@ -168,6 +168,9 @@ if ((! defined $router_list{$FORM{router}}) ||
 	exit;
 }
 
+$FORM{addr} =~ s/\s.*// if (($FORM{query} eq "ping") || ($FORM{query} eq "trace"));
+$FORM{addr} =~ s/[^\s\d\.:\w\-_\/\$]//g;
+
 if ($router_list{$FORM{router}} =~ /^http[s]{0,1}:/) {
 	if ($logfile ne "") {
 		print LOG " \"$FORM{router}\" \"$FORM{query}" . ($FORM{addr} ne "" ? " $FORM{addr}" : "") . "\"\n";