Mirrored_Repos/crafty-4
1
0
Fork 0
mirror of https://gitlab.com/crafty-controller/crafty-4.git synced 2024-08-30 18:23:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add java selection POST check

Browse Source 
Protect against tampered post requests to front end

Co-authored-by: andrew.charles.mcmanus@gmail.com <andrew.charles.mcmanus@gmail.com>
This commit is contained in:
Zedifus 2022-06-21 18:39:20 +01:00
parent e2d5e7cb69
commit 176f5a4004
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
app/classes/web/panel_handler.py
View File

@ -1389,6 +1389,21 @@ class PanelHandler(BaseHandler):
return
execution_list = shlex.split(execution_command)
if java_selection:
if not any(
java_selection in path for path in Helpers.find_java_installs()
):
self.redirect(
"/panel/error?error=Attack attempted."
+ " A copy of this report is being sent to server owner."
)
self.controller.management.add_to_audit_log_raw(
exec_user["username"],
exec_user["user_id"],
server_id,
f"Attempted to send bad java path for {server_id}."
+ " Possible attack. Act accordingly.",
self.get_remote_ip(),
)
if java_selection != "java":
if (
self.helper.is_os_windows()