Changeset 176 for trunk/dns.cgi

Timestamp:

12/01/11 14:58:18 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Remove some more stale commented code
Remove redundant call to initialze $searchsubs
Security review (see #30)

• set $webvar{page} a little earlier so we don't clutter the session with unusable data
• tweak initialization of $searchsubs. Improved but will still behave a bit strangely if extra data is deliberately or accidentally added to $webvar{searchsubs} (see #31)

File:

• trunk/dns.cgi (modified) (4 diffs)

trunk/dns.cgi

@@ -83 +83 @@
   $session->param('reclistsortby','host');
   $session->param('reclistorder','ASC');
-#  $session->param('filter','login');
-#  $session->param('startwith','login');
-#  $session->param('searchsubs','login');
 }
 
@@ -103 +100 @@
 my $curgroup = ($session->param('curgroup') ? $session->param('curgroup') : $logingroup);
 
+# decide which page to spit out...
+# also set $webvar{page} before we try to use it.
+$webvar{page} = 'login' if !$webvar{page};
+
 # per-page startwith, filter, searchsubs
 
@@ -109 +110 @@
 # not much call for chars not allowed in domain names
 $webvar{filter} =~ s/[^a-zA-Z0-9_.:@-]//g if $webvar{filter};
+## only set 'y' if box is checked, no other values legal
+## however, see https://secure.deepnet.cx/trac/dnsadmin/ticket/31
+# first, drop obvious fakes
+delete $webvar{searchsubs} if $webvar{searchsubs} && $webvar{searchsubs} !~ /^[ny]/;
+# strip the known "turn me off!" bit.
+$webvar{searchsubs} =~ s/^n\s?// if $webvar{searchsubs};
+# strip non-y/n - note this legitimately allows {searchsubs} to go empty
+$webvar{searchsubs} =~ s/[^yn]//g if $webvar{searchsubs};
 
 $session->param($webvar{page}.'startwith', $webvar{startwith}) if defined($webvar{startwith});
 $session->param($webvar{page}.'filter', $webvar{filter}) if defined($webvar{filter});
-$webvar{searchsubs} =~ s/^n ?// if $webvar{searchsubs};
 $session->param($webvar{page}.'searchsubs', $webvar{searchsubs}) if defined($webvar{searchsubs});
-
-# decide which page to spit out...
-# also set $webvar{page} before we try to use it.
-$webvar{page} = 'login' if !$webvar{page};
 
 my $startwith = $session->param($webvar{page}.'startwith');
@@ -1741 +1745 @@
 
 sub listdomains {
-
-  $searchsubs = $session->param($webvar{page}.'searchsubs');
 
 # ACLs