Add variable validation to the webgui and specific captive portal functions for per...

git-svn-id: https://svn.m0n0.ch/wall/trunk@141 e36fee2c-cc09-0410-a7cc-ebac5c6737de

diff --git a/captiveportal/index.php b/captiveportal/index.php
index dbe477b9b31723d402a7e3a460f5908300c97890..cc6edfe9b06914a44629e4e544de96e6dffbc2fe 100755 (executable)
--- a/captiveportal/index.php
+++ b/captiveportal/index.php
@@ -290,17 +290,17 @@ function portal_allow($clientip,$clientmac,$username,$password = null, $attribut
          */
         $peruserbw = isset($config['captiveportal']['peruserbw']);
 
-        $bw_up = !empty($attributes['bw_up']) ? trim($attributes['bw_up']) : $config['captiveportal']['bwdefaultup'];
-        $bw_down = !empty($attributes['bw_down']) ? trim($attributes['bw_down']) : $config['captiveportal']['bwdefaultdn'];
+        $bw_up = isset($attributes['bw_up']) ? trim($attributes['bw_up']) : $config['captiveportal']['bwdefaultup'];
+        $bw_down = isset($attributes['bw_down']) ? trim($attributes['bw_down']) : $config['captiveportal']['bwdefaultdn'];
 
-        if ($peruserbw && !empty($bw_up)) {
+        if ($peruserbw && !empty($bw_up) && is_numeric($bw_up)) {
             $bw_up_pipeno = $ruleno + 40500;
             exec("/sbin/ipfw add $ruleno set 2 pipe $bw_up_pipeno ip from $clientip to any in");
             exec("/sbin/ipfw pipe $bw_up_pipeno config bw {$bw_up}Kbit/s queue 100");
         } else {
             exec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from $clientip to any in");
         }
-        if ($peruserbw && !empty($bw_down)) {
+        if ($peruserbw && !empty($bw_down) && is_numeric($bw_down)) {
             $bw_down_pipeno = $ruleno + 45500;
             exec("/sbin/ipfw add $ruleno set 2 pipe $bw_down_pipeno ip from any to $clientip out");
             exec("/sbin/ipfw pipe $bw_down_pipeno config bw {$bw_down}Kbit/s queue 100");

diff --git a/webgui/services_captiveportal.php b/webgui/services_captiveportal.php
index bf56d7360fc131e879b5cc404f487a1b5c62457f..c3f51333485983977727e5129bf9d510af988c18 100755 (executable)
--- a/webgui/services_captiveportal.php
+++ b/webgui/services_captiveportal.php
@@ -123,6 +123,12 @@ if ($_POST) {
        if ($_POST['idletimeout'] && (!is_numeric($_POST['idletimeout']) || ($_POST['idletimeout'] < 1))) {
                $input_errors[] = "The idle timeout must be at least 1 minute.";
        }
+       if ($_POST['bwdefaultdn'] && (!is_numeric($_POST['bwdefaultdn']) || ($_POST['bwdefaultdn'] < 16))) {
+               $input_errors[] = "The per-user bandwidth download speed must be at least 16.";
+       }
+       if ($_POST['bwdefaultup'] && (!is_numeric($_POST['bwdefaultup']) || ($_POST['bwdefaultup'] < 16))) {
+               $input_errors[] = "The per-user bandwidth upload speed must be at least 16.";
+       }
        if (($_POST['radiusip'] && !is_ipaddr($_POST['radiusip']))) {
                $input_errors[] = "A valid IP address must be specified. [".$_POST['radiusip']."]";
        }