Project

General

Profile

« Previous | Next » 

Revision 739e227a

Added by Ermal LUÇI almost 14 years ago

Plug a security risk on CP where a user can login by submitting a special request

View differences:

usr/local/captiveportal/index.php
193 193
        captiveportal_logportalauth($_POST['auth_user'],$clientmac,$clientip,"FAILURE");
194 194
        portal_reply_page($redirurl, "error", $errormsg);
195 195
    }
196
} else if ($_POST['accept'] && $clientip) {
196
} else if ($_POST['accept'] && $clientip && $config['captiveportal']['auth_method'] == "none") {
197 197
    captiveportal_logportalauth("unauthenticated",$clientmac,$clientip,"ACCEPT");
198 198
    portal_allow($clientip, $clientmac, "unauthenticated");
199 199
} else {

Also available in: Unified diff