Merge branch 'fix/gh-112' into 'master'

* Fix security vulnerability in ping function. See merge request easycorp/zentaopms!7409
2023-04-14 01:21:02 +00:00
parent 8d4b6e5dcc 9e6711bbb2
commit 85f42ed822
1 changed files with 5 additions and 12 deletions
@@ -114,25 +114,18 @@ class zahostModel extends model
     */
    public function ping($address)
    {
-        if (strcasecmp(PHP_OS, 'WINNT') === 0)
+        if(!filter_var($address, FILTER_VALIDATE_IP) && !filter_var(gethostbyname($address), FILTER_VALIDATE_IP)) return false;
+
+        if(strcasecmp(PHP_OS, 'WINNT') === 0)
        {
            exec("ping -n 1 {$address}", $outcome, $status);
        }
-        elseif (strcasecmp(PHP_OS, 'Linux') === 0)
+        elseif(strcasecmp(PHP_OS, 'Linux') === 0)
        {
            exec("ping -c 1 {$address}", $outcome, $status);
        }

-        if (0 == $status)
-        {
-            $status = true;
-        }
-        else
-        {
-            $status = false;
-        }
-
-        return $status;
+        return 0 == $status;
    }

    /**