projects
/
project
/
luci.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
luci-base: fix possible shell injection in luci.tools.status.switch_status()
[project/luci.git]
/
modules
/
luci-base
/
luasrc
/
tools
/
status.lua
diff --git
a/modules/luci-base/luasrc/tools/status.lua
b/modules/luci-base/luasrc/tools/status.lua
index
5012111
..
1c40387
100644
(file)
--- a/
modules/luci-base/luasrc/tools/status.lua
+++ b/
modules/luci-base/luasrc/tools/status.lua
@@
-187,7
+187,7
@@
function switch_status(devs)
local switches = { }
for dev in devs:gmatch("[^%s,]+") do
local ports = { }
- local swc = io.popen("swconfig dev
%q show" % dev
, "r")
+ local swc = io.popen("swconfig dev
'%s' show" % dev:gsub("'", "")
, "r")
if swc then
local l
repeat