OS Injection issue with plugins

https://huntr.dev/bounties/1624730404898-FalconChristmas/fpp/
FalconChristmas · Jun 26, 2021 · 8bfba3c · 8bfba3c
1 parent 3cb9c99
commit 8bfba3c
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/scripts/install_plugin b/scripts/install_plugin
@@ -15,6 +15,12 @@ teeOutput
 
 echo "Installing plugin $1"
 cd ${PLUGINDIR} && $SUDO git clone --single-branch --branch $3 $2 $1
+rc=$?
+if [ $rc -ne 0 ]; then
+	echo "Failed to fetch $1 using $2 -- aborting"
+	exit 1
+fi
+
 if [ "x$4" != "x" ]
 then
 	(cd $1 && $SUDO git reset --hard $4)

diff --git a/www/api/controllers/plugin.php b/www/api/controllers/plugin.php
@@ -41,9 +41,9 @@ function InstallPlugin()
 
 	$pluginInfo = json_decode($pluginInfoJSON, true);
 
-	$plugin = $pluginInfo['repoName'];
+	$plugin = escapeshellcmd($pluginInfo['repoName']);
 	$srcURL = $pluginInfo['srcURL'];
-	$branch = $pluginInfo['branch'];
+	$branch = escapeshellcmd($pluginInfo['branch']);
 	$sha = $pluginInfo['sha'];
 	$infoURL = $pluginInfo['infoURL'];