Fix: Security hole.

diff --git a/wwwroot/cgi-bin/plugins/rawlog.pm b/wwwroot/cgi-bin/plugins/rawlog.pm
index f277046354e89e5540996bba5e219ceef9c37e8f..4f92fd8e01750df21452bac3adbdd68118668ca1 100644 (file)
--- a/wwwroot/cgi-bin/plugins/rawlog.pm
+++ b/wwwroot/cgi-bin/plugins/rawlog.pm
@@ -81,6 +81,12 @@ sub BuildFullHTMLOutput_rawlog {
        my $Filter='';
        if ($QueryString =~ /filterrawlog=([^&]+)/i) { $Filter=&DecodeEncodedString("$1"); }
 
+    # A security check
+       if ($QueryString =~ /logfile=/i) { 
+           print "<br>Option logfile is not allowed while building rawlog output.<br>";
+        return 0;
+       }
+
        # Show form
        &_ShowForm($Filter);