Mirrored_Repos/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/jc21/nginx-proxy-manager.git synced 2024-08-30 18:22:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2635 from skarlcf/security/CVE-2023-23596

Browse Source 
Mitigate CVE-2023-23596
This commit is contained in:
jc21 2023-03-08 08:25:38 +10:00 committed by GitHub
commit 30076a0e66
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/internal/access-list.js
View File

@ -507,7 +507,7 @@ const internalAccessList = {
if (typeof item.password !== 'undefined' && item.password.length) {
logger.info('Adding: ' + item.username);
utils.exec('/usr/bin/htpasswd -b "' + htpasswd_file + '" "' + item.username + '" "' + item.password + '"')
utils.execFile('/usr/bin/htpasswd', ['-b', htpasswd_file, item.username, item.password])
.then((/*result*/) => {
next();
})

19
backend/lib/utils.js
View File

@ -1,4 +1,5 @@
const exec = require('child_process').exec;
const exec = require('child_process').exec;
const execFile = require('child_process').execFile;
module.exports = {
@ -16,5 +17,21 @@ module.exports = {
}
});
});
},
/**
* @param {Array} cmd
* @returns {Promise}
*/
execFile: function (cmd) {
return new Promise((resolve, reject) => {
execFile(cmd, function (err, stdout, /*stderr*/) {
if (err && typeof err === 'object') {
reject(err);
} else {
resolve(stdout.trim());
}
});
});
}
};