From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Tue, 1 Aug 2023 15:48:38 +0000 (+0200)
Subject: extrahd.cgi: Do not allow "/mnt" or "/media" as mount points
X-Git-Tag: v2.27-core179~9^2~75
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=19a3b883ded2a4960ae841212fb59c4600fca92d;p=ipfire-2.x.git

extrahd.cgi: Do not allow "/mnt" or "/media" as mount points

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi
index 122f1d12d7..bd64dff070 100644
--- a/html/cgi-bin/extrahd.cgi
+++ b/html/cgi-bin/extrahd.cgi
@@ -667,6 +667,10 @@ sub is_mounted ($) {
 sub is_valid_dir ($) {
 	my ($mpoint) = @_;
 
+	# Do not allow "/mnt" or "/media" as mount points.
+	return if($mpoint eq "/mnt");
+	return if($mpoint eq "/media");
+
 	# Split the given mountpoint into pieces and store them
 	# in a temporay array.
 	my @tmp = split("/", $mpoint);