From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 24 Nov 2010 05:05:39 +0000 (+0000)
Subject: applications/luci-wol: fix XSS
X-Git-Tag: 0.10.0~374
X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=commitdiff_plain;h=305b25486af424d89ccfc2fd7607579f90735602

applications/luci-wol: fix XSS
---

diff --git a/applications/luci-wol/luasrc/model/cbi/wol.lua b/applications/luci-wol/luasrc/model/cbi/wol.lua
index ac73919e2..30467f430 100644
--- a/applications/luci-wol/luasrc/model/cbi/wol.lua
+++ b/applications/luci-wol/luasrc/model/cbi/wol.lua
@@ -48,7 +48,7 @@ if has_ewk then
 	end
 
 	iface:value("", translate("Broadcast on all interfaces"))
-	
+
 	for _, e in ipairs(sys.net.devices()) do
 		if e ~= "lo" then iface:value(e) end
 	end
@@ -86,7 +86,7 @@ end
 
 function host.write(self, s, val)
 	local host = luci.http.formvalue("cbid.wol.1.mac")
-	if host and #host > 0 then
+	if host and #host > 0 and host:match("^[a-fA-F0-9:]+$") then
 		local cmd
 		local util = luci.http.formvalue("cbid.wol.1.binary") or (
 			has_ewk and "/usr/bin/etherwake" or "/usr/bin/wol"
@@ -127,4 +127,3 @@ end
 
 
 return m
-