upstream/opnsense-plugins
1
0
Fork 0
mirror of https://github.com/opnsense/plugins.git synced 2026-02-03 20:40:37 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

net/upnp: safe execution change

Browse source 
shell_safe() is better than raw exec() although we do not have any
dynamic shell arguments to handle.  This call requires a new explode
extension (true parameter) that will be available in 25.7.8
This commit is contained in:
Franco Fichtner 2025-11-17 21:39:54 -05:00
parent e2601dc289
commit db0943a4a2
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/upnp/src/www/status_upnp.php
View file

@ -29,6 +29,7 @@
require_once("guiconfig.inc");
require_once("interfaces.inc");
require_once("util.inc");
require_once("plugins.inc.d/miniupnpd.inc");
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
@ -42,8 +43,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
}
}
$rdr_entries = array();
exec("/sbin/pfctl -P -a miniupnpd -s nat; /sbin/pfctl -P -a miniupnpd -s rules", $rdr_entries, $pf_ret);
$rdr_entries = shell_safe('/sbin/pfctl -P -a miniupnpd -s nat; /sbin/pfctl -P -a miniupnpd -s rules', [], true);
$service_hook = 'miniupnpd';
include("head.inc");