DHCP: Escape slashes in filename

Fixes: #12006
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/dhcp.cgi b/html/cgi-bin/dhcp.cgi
index 3eb5349a9f70ec7efee12ff0a40f2f5ae11041c7..82c6b20665eed798b55d8366379d463fcf508572 100644 (file)
--- a/html/cgi-bin/dhcp.cgi
+++ b/html/cgi-bin/dhcp.cgi
@@ -1272,7 +1272,7 @@ sub buildconf {
            print FILE ", " . $dhcpsettings{"WINS2_${itf}"}                            if ($dhcpsettings{"WINS2_${itf}"});
            print FILE ";\n"                                                           if ($dhcpsettings{"WINS1_${itf}"});
            print FILE "\tnext-server " . $dhcpsettings{"NEXT_${itf}"} . ";\n" if ($dhcpsettings{"NEXT_${itf}"});
-           print FILE "\tfilename \"" . $dhcpsettings{"FILE_${itf}"} . "\";\n" if ($dhcpsettings{"FILE_${itf}"});
+           print FILE "\tfilename \"" . &EscapeFilename($dhcpsettings{"FILE_${itf}"}) . "\";\n" if ($dhcpsettings{"FILE_${itf}"});
            print FILE "\tdefault-lease-time " . ($dhcpsettings{"DEFAULT_LEASE_TIME_${itf}"} * 60). ";\n";
            print FILE "\tmax-lease-time "     . ($dhcpsettings{"MAX_LEASE_TIME_${itf}"} * 60)    . ";\n";
            print FILE "\tallow bootp;\n" if ($dhcpsettings{"ENABLEBOOTP_${itf}"} eq 'on');
@@ -1325,7 +1325,7 @@ sub buildconf {
            print FILE "\thardware ethernet $temp[0];\n";
            print FILE "\tfixed-address $temp[1];\n";
            print FILE "\tnext-server $temp[3];\n"          if ($temp[3]);
-           print FILE "\tfilename \"$temp[4]\";\n"         if ($temp[4]);
+           print FILE "\tfilename \"" . &EscapeFilename($temp[4]) . "\";\n" if ($temp[4]);
            print FILE "\toption root-path \"$temp[5]\";\n" if ($temp[5]);
            print FILE "}\n";
            $key++;
@@ -1392,3 +1392,12 @@ sub IsUsedNewOptionDefinition {
     }
     return 0;
 }
+
+sub EscapeFilename($) {
+       my $filename = shift;
+
+       # Replace all single / by \/
+       $filename =~ s/\//\\\//g;
+
+       return $filename;
+}