Merge pull request #123 from pi-hole/fix-get-php-file-param

Fix possible list param exploit
2024-12-06 19:36:21 +01:00 · 2016-08-16 16:11:38 -04:00
parent 1208af8277 62feb36640
commit d573aace4a
1 changed files with 4 additions and 0 deletions
@@ -3,6 +3,10 @@ if(!isset($_GET['list']))
    die();

 $type = $_GET['list'];
+
+if($type !== "white" && $type !== "black")
+    die("Invalid list parameter");
+
 $rawList = file_get_contents("/etc/pihole/${type}list.txt");
 $list = explode("\n", $rawList);