diff options
| -rwxr-xr-x | contrib/scripts/vmail.cgi | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/contrib/scripts/vmail.cgi b/contrib/scripts/vmail.cgi index 5a428970d..4ac1c8579 100755 --- a/contrib/scripts/vmail.cgi +++ b/contrib/scripts/vmail.cgi @@ -545,14 +545,16 @@ _EOH sub message_audio() { my ($forcedownload) = @_; - my $folder = param('folder'); - my $msgid = param('msgid'); - my $mailbox = param('mailbox'); - my $context = param('context'); + my $folder = &untaint(param('folder')); + my $msgid = &untaint(param('msgid')); + my $mailbox = &untaint(param('mailbox')); + my $context = &untaint(param('context')); my $format = param('format'); if (!$format) { $format = &getcookie('format'); } + &untaint($format); + my $path = "/var/spool/asterisk/voicemail/$context/$mailbox/$folder/msg${msgid}.$format"; $msgid =~ /^\d\d\d\d$/ || die("Msgid Liar ($msgid)!"); |