From 05c14ce868dd2d5f5020462c09dfbf393990142d Mon Sep 17 00:00:00 2001
From: nachoparker <nacho@ownyourbits.com>
Date: Mon, 4 Jun 2018 19:29:32 +0200
Subject: ncp-web: sanitize the ref parameter

---
 ncp-web/ncp-launcher.php | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'ncp-web/ncp-launcher.php')

diff --git a/ncp-web/ncp-launcher.php b/ncp-web/ncp-launcher.php
index 5e8ceafc..0b28f4c8 100644
--- a/ncp-web/ncp-launcher.php
+++ b/ncp-web/ncp-launcher.php
@@ -92,8 +92,12 @@ if ( $_POST['action'] == "cfgreq" )
 
 else if ( $_POST['action'] == "launch" && $_POST['config'] )
 {
+  // sanity checks
   if ( !$_POST['ref'] ) exit( '{ "output": "Invalid request" }' );
 
+  preg_match( '/^[a-z-]+$/' , $_POST['ref'] , $matches )
+    or exit( '{ "output": "Invalid input" , "token": "' . getCSRFToken() . '" }' );
+
   // CSRF check
   $token = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : '';
   if ( empty($token) || !validateCSRFToken($token) )
-- 
cgit v1.2.3