pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1200 from pi-hole/tweak/validate_groups_input

Browse Source 
Check adlist URL for valid characters before adding record to the database
This commit is contained in:
Adam Warner
2020-03-31 21:47:09 +01:00
committed by GitHub
parent 6fdeee53ca f0034b305d
commit c2671b3790
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/pi-hole/php/groups.php
+6 -1
View File
@@ -600,12 +600,17 @@ if ($_POST['action'] == 'get_groups') {
} elseif ($_POST['action'] == 'add_adlist') {
// Add new adlist
try {
$address = $_POST['address'];
if(preg_match("/[^a-zA-Z0-9:\/?&%=~._-]/", $address) !== 0) {
throw new Exception('Invalid adlist URL');
}
$stmt = $db->prepare('INSERT INTO adlist (address,comment) VALUES (:address,:comment)');
if (!$stmt) {
throw new Exception('While preparing statement: ' . $db->lastErrorMsg());
}
if (!$stmt->bindValue(':address', $_POST['address'], SQLITE3_TEXT)) {
if (!$stmt->bindValue(':address', $address, SQLITE3_TEXT)) {
throw new Exception('While binding address: ' . $db->lastErrorMsg());
}