security: Stop accepting other variables in install that we do not use (

librenms#7511)
nox-x · Oct 18, 2017 · cbc2757 · cbc2757
1 parent 9009633
commit cbc2757
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/html/install.php b/html/install.php
@@ -3,7 +3,12 @@
 if (empty($_POST) && !empty($_SESSION) && !isset($_REQUEST['stage'])) {
     $_POST = $_SESSION;
 } elseif (!file_exists("../config.php")) {
-    $_SESSION = array_replace($_SESSION, $_POST);
+    $allowed_vars = array('stage','build-ok','dbhost','dbuser','dbpass','dbname','dbport','dbsocket','add_user','add_pass','add_email');
+    foreach ($allowed_vars as $allowed) {
+        if (isset($_POST[$allowed])) {
+            $_SESSION[$allowed] = $_POST[$allowed];
+        }
+    }
 }
 
 $stage = isset($_POST['stage']) ? $_POST['stage'] : 0;