webinterface.git

@@ -17,6 +17,10 @@ function filter_quotes( $input )

         return ereg_replace('["\'`]', '', $input );

 }

+function filter_shell( $input )

+{

+        return ereg_replace('["\'` \t\r\n]', '', $input );

+}

 ?>

@@ -46,7 +46,7 @@ function create_jabber_account($local, $domain, $password)

   $local = mysql_real_escape_string( filter_input_username($local) );

   $domain = (int) $domain;

-  $password = mysql_real_escape_string( filter_quotes( $password ) );

+  $password = mysql_real_escape_string( filter_shell( $password ) );

   if ($domain > 0)

   {

@@ -85,7 +85,7 @@ function change_jabber_password($id, $newpass)

   require_role(ROLE_CUSTOMER);

   $customerno = (int) $_SESSION['customerinfo']['customerno'];

   $id = (int) $id;

-  $newpass = mysql_real_escape_string( filter_quotes( $newpass ) );

+  $newpass = mysql_real_escape_string( filter_shell( $newpass ) );

   $query = "UPDATE jabber.accounts SET password='{$newpass}' WHERE customerno={$customerno} AND id={$id} LIMIT 1";

   DEBUG($query);