From b2672b93a0917d7efea54e6692458e71a091dbd3 Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Fri, 28 Nov 2014 20:28:22 -0600
Subject: touch up arpwatch, add escaping to iperf

---
 config/iperfserver.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'config/iperfserver.xml')

diff --git a/config/iperfserver.xml b/config/iperfserver.xml
index 493c41c8..f0dc074a 100644
--- a/config/iperfserver.xml
+++ b/config/iperfserver.xml
@@ -130,10 +130,10 @@
 		$iperf_options = "";
 		if($_POST['protocol'] == "udp") $iperf_options .= " -u";
 		if($_POST['format'] == "bytes") $iperf_options .= " -f A";
-		if($_POST['interval'] != "") $iperf_options .= " -i {$_POST['interval']}";
-		if($_POST['length'] != "") $iperf_options .= " -l {$_POST['length']}";
-		if($_POST['window'] != "") $iperf_options .= " -w {$_POST['window']}";
-		if($_POST['port'] != "") $iperf_options .= " -p {$_POST['port']}";
+		if($_POST['interval'] != "") $iperf_options .= " -i " . escapeshellarg($_POST['interval']);
+		if($_POST['length'] != "") $iperf_options .= " -l " . escapeshellarg($_POST['length']);
+		if($_POST['window'] != "") $iperf_options .= " -w " . escapeshellarg($_POST['window']);
+		if($_POST['port'] != "") $iperf_options .= " -p " . escapeshellarg($_POST['port']);
 		$iperf_options .= " -s";
 		mwexec_bg("/usr/local/bin/iperf" . $iperf_options);
 	</custom_add_php_command>
-- 
cgit v1.2.3