From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Mon, 10 Jul 2023 19:26:47 +0000 (+0200)
Subject: extrahd.cgi: Do not allow "/mnt" or "/media" as mount points
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a9b4c685d72ed6a96522348331d1cc177ecea00d;p=people%2Fstevee%2Fipfire-2.x.git

extrahd.cgi: Do not allow "/mnt" or "/media" as mount points

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---

diff --git a/html/cgi-bin/extrahd.cgi b/html/cgi-bin/extrahd.cgi
index 122f1d12d7..bd64dff070 100644
--- a/html/cgi-bin/extrahd.cgi
+++ b/html/cgi-bin/extrahd.cgi
@@ -667,6 +667,10 @@ sub is_mounted ($) {
 sub is_valid_dir ($) {
 	my ($mpoint) = @_;
 
+	# Do not allow "/mnt" or "/media" as mount points.
+	return if($mpoint eq "/mnt");
+	return if($mpoint eq "/media");
+
 	# Split the given mountpoint into pieces and store them
 	# in a temporay array.
 	my @tmp = split("/", $mpoint);