From f0034b305d1e929e7fb0c7be7153d166d4753f3c Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Tue, 31 Mar 2020 20:41:50 +0000
Subject: [PATCH] Check adlist URL for valid characters before adding record to
 the database.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/php/groups.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/scripts/pi-hole/php/groups.php b/scripts/pi-hole/php/groups.php
index e5144eeb..1ef3695f 100644
--- a/scripts/pi-hole/php/groups.php
+++ b/scripts/pi-hole/php/groups.php
@@ -600,12 +600,17 @@ if ($_POST['action'] == 'get_groups') {
 } elseif ($_POST['action'] == 'add_adlist') {
     // Add new adlist
     try {
+        $address = $_POST['address'];
+        if(preg_match("/[^a-zA-Z0-9:\/?&%=~._-]/", $address) !== 0) {
+            throw new Exception('Invalid adlist URL');
+        }
+
         $stmt = $db->prepare('INSERT INTO adlist (address,comment) VALUES (:address,:comment)');
         if (!$stmt) {
             throw new Exception('While preparing statement: ' . $db->lastErrorMsg());
         }
 
-        if (!$stmt->bindValue(':address', $_POST['address'], SQLITE3_TEXT)) {
+        if (!$stmt->bindValue(':address', $address, SQLITE3_TEXT)) {
             throw new Exception('While binding address: ' . $db->lastErrorMsg());
         }