]> git.ipfire.org Git - thirdparty/asterisk.git/commit
manager.c: Prevent the Originate action from running the Originate app
authorGeorge Joseph <gjoseph@digium.com>
Thu, 24 Oct 2019 17:41:23 +0000 (11:41 -0600)
committerGerrit <noreply@gerrit.asterisk.org>
Thu, 21 Nov 2019 15:40:41 +0000 (09:40 -0600)
commit7574be5110e049a44b8c8ead52cd1c2a5d442afa
tree67594544daaceb11185245675a7009ad7ce528eb
parenta1eb0d73559e39ecfaa37f36e79eec4bea52bce9
manager.c:  Prevent the Originate action from running the Originate app

If an AMI user without the "system" authorization calls the
Originate AMI command with the Originate application,
the second Originate could run the "System" command.

Action: Originate
Channel: Local/1111
Application: Originate
Data: Local/2222,app,System,touch /tmp/owned

If the "system" authorization isn't set, we now block the
Originate app as well as the System, Exec, etc. apps.

ASTERISK-28580
Reported by: Eliel SardaƱons

Change-Id: Ic4c9dedc34c426f03c8c14fce334a71386d8a5fa
doc/UPGRADE-staging/AMI-Originate.txt [new file with mode: 0644]
main/manager.c