ezmlm-web/ezmlm-web
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Ticket #48

Browse source 
ezmlm-web.cgi
 - synced regexps in create_list and untaint
This commit is contained in:
jlmartinez 2008-07-11 09:42:24 +00:00
parent 1f699d3cba
commit 00034f178d
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ezmlm-web.cgi
View file

@ -1457,7 +1457,7 @@ sub untaint {
# check the list name
if (defined($q->param('list')) &&
($q->param('list') =~ /[^\w\.-]/) &&
($q->param('list') !~ m/^[\w\d\_\-\.\/\@]+$/) &&
($q->param('action') !~ /^list_create_(do|ask)$/)) {
$warning = 'InvalidListName' if ($warning eq '');
$q->param(-name=>'list', -values=>'');
@ -1651,7 +1651,7 @@ sub create_list {
# dotqmail files may not contain uppercase letters
$qmail = lc($qmail);
$listname = $q->param('list');
if ($listname =~ m/[^\w\.-]/) {
if ($listname !~ m/^[\w\d\_\-\.\/\@]+$/) {
$warning = 'InvalidListName';
return (1==0);
}