Merge pull request pi-hole#866 from pi-hole/fix/admin-email-security

Prevent possible attacks via admin email setting
bweave · Dec 7, 2018 · 00295ba · 00295ba
2 parents 48e65ee + 064e652
commit 00295ba
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/scripts/pi-hole/php/savesettings.php b/scripts/pi-hole/php/savesettings.php
@@ -476,13 +476,13 @@ function readAdlists()
 				{
 					$adminemail = 'noadminemail';
 				}
-				elseif(!filter_var($adminemail, FILTER_VALIDATE_EMAIL))
+				elseif(!filter_var($adminemail, FILTER_VALIDATE_EMAIL) || strpos($adminemail, "'") !== false)
 				{
 					$error .= "Administrator email address (".htmlspecialchars($adminemail).") is invalid!<br>";
 				}
 				else
 				{
-					exec('sudo pihole -a -e '.$adminemail);
+					exec('sudo pihole -a -e \''.$adminemail.'\'');
 				}
 				if(isset($_POST["boxedlayout"]))
 				{