Merge pull request #386 from ALE-Rainbow/fixIPPermissionSQLInjection

fix the webadmin ip permission add/delete sql injection
7 years ago · 7f8ff54860
parent c4477bfddd cf938cd915
commit 7f8ff54860
1 changed files with 4 additions and 0 deletions
--- a/src/apps/relay/turn_admin_server.c
+++ b/src/apps/relay/turn_admin_server.c
@ -3230,6 +3230,8 @@ static void handle_update_request(ioa_socket_handle s, struct http_request* hr)

 					if(current_realm()[0] && strcmp(current_realm(),r)) {
 						//forbidden
+					} else if (strcmp(kind, "allowed") != 0 && strcmp(kind, "denied") != 0) {
+						//forbidden
 					} else {

 						uint8_t realm[STUN_MAX_REALM_SIZE+1]="\0";
@ -3263,6 +3265,8 @@ static void handle_update_request(ioa_socket_handle s, struct http_request* hr)

 						if(current_realm()[0] && strcmp(current_realm(),r)) {
 							//forbidden
+						} else if (strcmp(kind, "allowed") != 0 && strcmp(kind, "denied") != 0) {
+							//forbidden
 						} else {

 							uint8_t realm[STUN_MAX_REALM_SIZE+1]="\0";