Changeset 6016

Show
Ignore:
Timestamp:
07/15/08 16:59:17 (5 years ago)
Author:
p_lindheimer
Message:

#2917 run CLI commands through the manager to avoid secrity issues trying to exec commands

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/branches/2.5/asterisk-cli/module.xml

    r5427 r6016  
    22  <rawname>asterisk-cli</rawname> 
    33  <name>Asterisk CLI</name> 
    4   <version>2.4.0</version> 
     4  <version>2.5.0</version> 
    55  <type>tool</type> 
    66  <category>System Administration</category> 
    …… 
    1414  <md5sum>bf0e8951ff0b8bce0a3f826f586d0677</md5sum> 
    1515  <changelog> 
     16    *2.5.0* #2917 execute CLI command direct through manager to remove vulnerabilities 
    1617    *2.4.0* 2.4 branch (added IT translations also) 
    1718    *1.1.2.1* bump for rc1 

  • modules/branches/2.5/asterisk-cli/page.cli.php

    r5919 r6016  
    6262if (!isBlank($txtCommand)) 
    6363{ 
    64   echo "<pre>"; 
    65   putenv("TERM=vt100"); 
    66   putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"); 
    67   putenv("SCRIPT_FILENAME=" . strtok(stripslashes($txtCommand), " "));  /* PHP scripts */ 
    68   $badchars = array("'", "`", "\\", ";", "\""); // Strip off any nasty chars. 
    69   $fixedcmd = str_replace($badchars, "", $txtCommand); 
    70   $ph = popen(stripslashes("asterisk -nrx \"$fixedcmd\""), "r" ); 
    71   while ($line = fgets($ph)) 
    72     echo htmlspecialchars($line); 
    73   pclose($ph); 
    74   echo "</pre>"; 
     64  $html_out = cli_runcommand($txtCommand); 
     65  echo $html_out; 
    7566} 
    7667