summaryrefslogtreecommitdiff
path: root/src/locale
diff options
context:
space:
mode:
Diffstat (limited to 'src/locale')
-rw-r--r--src/locale/localed.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/src/locale/localed.c b/src/locale/localed.c
index a2d381406c..04268a1982 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -1039,7 +1039,9 @@ static DBusHandlerResult locale_message_handler(
size_t k;
k = strlen(names[p]);
- if (startswith(*i, names[p]) && (*i)[k] == '=') {
+ if (startswith(*i, names[p]) &&
+ (*i)[k] == '=' &&
+ string_is_safe((*i) + k + 1)) {
valid = true;
passed[p] = true;
@@ -1150,6 +1152,10 @@ static DBusHandlerResult locale_message_handler(
if (!streq_ptr(keymap, state.vc_keymap) ||
!streq_ptr(keymap_toggle, state.vc_keymap_toggle)) {
+ if ((keymap && (!filename_is_safe(keymap) || !string_is_safe(keymap))) ||
+ (keymap_toggle && (!filename_is_safe(keymap_toggle) || !string_is_safe(keymap_toggle))))
+ return bus_send_error_reply(connection, message, NULL, -EINVAL);
+
r = verify_polkit(connection, message, "org.freedesktop.locale1.set-keyboard", interactive, NULL, &error);
if (r < 0)
return bus_send_error_reply(connection, message, &error, r);
@@ -1220,6 +1226,12 @@ static DBusHandlerResult locale_message_handler(
!streq_ptr(variant, state.x11_variant) ||
!streq_ptr(options, state.x11_options)) {
+ if ((layout && !string_is_safe(layout)) ||
+ (model && !string_is_safe(model)) ||
+ (variant && !string_is_safe(variant)) ||
+ (options && !string_is_safe(options)))
+ return bus_send_error_reply(connection, message, NULL, -EINVAL);
+
r = verify_polkit(connection, message, "org.freedesktop.locale1.set-keyboard", interactive, NULL, &error);
if (r < 0)
return bus_send_error_reply(connection, message, &error, r);