luci-base: fix possible shell injection in luci.tools.status.switch_status()
authorJo-Philipp Wich <jo@mein.io>
Wed, 4 Apr 2018 22:32:28 +0000 (00:32 +0200)
committerJo-Philipp Wich <jo@mein.io>
Wed, 4 Apr 2018 22:32:56 +0000 (00:32 +0200)
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-base/luasrc/tools/status.lua

index 5012111815faf796b500e5a8a46f4abc7d707739..1c4038735faf4a04da415d33cd6355ba9436e74d 100644 (file)
@@ -187,7 +187,7 @@ function switch_status(devs)
        local switches = { }
        for dev in devs:gmatch("[^%s,]+") do
                local ports = { }
-               local swc = io.popen("swconfig dev %q show" % dev, "r")
+               local swc = io.popen("swconfig dev '%s' show" % dev:gsub("'", ""), "r")
                if swc then
                        local l
                        repeat