github/myvesta
1
0
Fork 0
mirror of https://github.com/myvesta/vesta synced 2025-08-20 05:14:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Restrict v-make-tmp-file to tmp folder

Browse source 
Thanks to @hestiacp and @jaapmarcus
This commit is contained in:
myvesta 2021-03-14 19:09:10 +01:00 • committed by GitHub
commit fdc6e191c2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
web/api/index.php
View file

@ -116,7 +116,7 @@ if (isset($_POST['user']) || isset($_POST['hash'])) {
// Check command // Check command
if ($cmd == "'v-make-tmp-file'") { if ($cmd == "'v-make-tmp-file'") {
// Used in DNS Cluster // Used in DNS Cluster
$fp = fopen($_POST['arg2'], 'w'); $fp = fopen('/tmp/'.basename($_POST['arg2']), 'w');
fwrite($fp, $_POST['arg1']."\n"); fwrite($fp, $_POST['arg1']."\n");
fclose($fp); fclose($fp);
$return_var = 0; $return_var = 0;