From: Marc MAURICE <marc-mlmmj@pub.positon.org>
To: mlmmj@mlmmj.org
Subject: Re: [mlmmj] Subscribers management in php-admin
Date: Tue, 28 Feb 2012 09:47:55 +0000 [thread overview]
Message-ID: <4F4CA2CB.1020301@pub.positon.org> (raw)
In-Reply-To: <4F4BFAA7.4060702@pub.positon.org>
I agree with you Thomas.
I forgot the check because the interface is http auth restricted, but
this is not not an excuse.
We should also fix the existing code in save.php.
Marc
Le 28/02/2012 10:25, Thomas Goirand a écrit :
> On 02/28/2012 05:50 AM, Marc MAURICE wrote:
>> +} else if (isset($_POST["delete"])) {
>> +
>> + $email = $_POST["email"];
>> + $cmd = "/usr/bin/mlmmj-unsub -L /var/spool/mlmmj/$list -a '$email' 2>&1";
> What if $email contains:
>
> '; rm -rf /
>
> Please don't accept such a weak code. At least, a minimum check on the
> validity of $email variable content should be made. In fact, and
> generally speaking, absolutely *all* input variables should be checked.
>
> Thomas
>
>
next prev parent reply other threads:[~2012-02-28 9:47 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-27 21:50 [mlmmj] Subscribers management in php-admin Marc MAURICE
2012-02-28 9:25 ` Thomas Goirand
2012-02-28 9:47 ` Marc MAURICE [this message]
2012-02-28 14:29 ` Ben Schmidt
2012-02-29 3:09 ` Thomas Goirand
2012-02-29 3:57 ` Ben Schmidt
2012-03-01 13:08 ` Marc MAURICE
2012-03-01 15:07 ` Thomas Goirand
2012-03-02 12:59 ` Marc MAURICE
2012-03-04 14:05 ` Ben Schmidt
2012-03-05 12:02 ` Marc MAURICE
2012-03-06 8:45 ` Mads Martin Jørgensen
2012-03-11 13:06 ` Ben Schmidt
2012-03-11 13:46 ` Ben Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F4CA2CB.1020301@pub.positon.org \
--to=marc-mlmmj@pub.positon.org \
--cc=mlmmj@mlmmj.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.