Merge pull request #4 from fser/master

limits the authorized characters for listname, to avoid command injection
AlternC · Jun 21, 2018 · fc18031 · fc18031
2 parents 9847152 + c760e7a
commit fc18031
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/bureau/admin/mman_doadd.php b/bureau/admin/mman_doadd.php
@@ -34,6 +34,12 @@
 );
 getFields($fields);
 
+if (preg_match('/^\w+$/', $login) === 0) {
+	$error=_('Invalid list name (only letters, digits and underscore).');
+	include("mman_add.php");
+	exit();
+}
+
 $r=$mailman->add_lst($domain,$login,$owner,$pass,$pass2);
 if (!$r) {
 	include("mman_add.php");