exozyme/scripts
3
1
Fork 1
Code Issues Pull requests Projects Releases Wiki Activity

Prevent arbitrary code execution in register script

Browse source
This commit is contained in:
Anthony Wang 2021-11-24 15:52:06 -06:00
parent 5f058a1f35
commit f5d5bf0489
Signed by: a
GPG key ID: BC96B00AEC5F2D76
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
register
View file

@ -10,8 +10,16 @@ class S(BaseHTTPRequestHandler):
data = loads(self.rfile.read(content_length).decode('utf-8'))
data['password'] = os.popen('slappasswd -s ' + data['password']).read()[:-1]
print(data)
if data['code'] != code:
bad = False
if data['code'] != code: bad = True
if not all(c.isdigit() or c.islower() for c in data['username']): bad = True
if not all(c.islower() or c.isupper() for c in data['firstname']): bad = True
if not all(c.islower() or c.isupper() for c in data['lastname']): bad = True
if not all(c.islower() or c.isupper() or c == '@' or c == '.' for c in data['email']): bad = True
if bad:
return
os.system('adduser ' + data['username'] + ' ' + data['firstname'] + ' ' + data['lastname'] + ' ' + data['email'] + ' ' + data['password'] + ' "' + ldap_pass + '"')
self.send_response(200)