From 080f9ce248daaab1dfaa74bbdfca36891dba6fa5 Mon Sep 17 00:00:00 2001
From: Adam Amstrong <adama@localhost>
Date: Thu, 13 Nov 2008 17:19:43 +0000
Subject: [PATCH] security fixes. AMG SECURIITAHHHHHHHHH!

git-svn-id: http://www.observium.org/svn/observer/trunk@305 61d68cd4-352d-0410-923a-c4978735b2b8
---
 html/netcmd.php | 43 ++++++++++++++++++++++++++++++-------------
 html/whois.php  | 10 ----------
 2 files changed, 30 insertions(+), 23 deletions(-)
 delete mode 100644 html/whois.php

diff --git a/html/netcmd.php b/html/netcmd.php
index 106fc66e4a..9c520c3b05 100644
--- a/html/netcmd.php
+++ b/html/netcmd.php
@@ -1,19 +1,36 @@
 <?php
 
-switch ($_GET[cmd]) {
-  case 'whois':
-    $output = `/usr/bin/whois $_GET[query] | grep -v \%`;
-    break;
-  case 'ping':
-    $output = `/bin/ping $_GET[query]`;
-    break;
-  case 'tracert':
-    $output = `/usr/sbin/traceroute $_GET[query]`;
-    break;
-  case 'nmap':
-    $output = `/usr/bin/nmap $_GET[query]`;
-    break;
+include_once("Net/IPv6.php");
+
+function check_ip($ip)
+{
+  if ($ip == long2ip(ip2long($ip))) {
+    return true;
+  } else {
+      return false;
+  }
 }
+
+if($_GET['query']) {
+  $ip = $_GET['query'];
+  if(Net_IPv6::checkIPv6($ip)||check_ip($ip)) {
+    switch ($_GET[cmd]) {
+      case 'whois':
+        $output = `/usr/bin/whois $_GET[query] | grep -v \%`;
+        break;
+      case 'ping':
+        $output = `/bin/ping $_GET[query]`;
+        break;
+      case 'tracert':
+        $output = `/usr/sbin/traceroute $_GET[query]`;
+        break;
+      case 'nmap':
+        $output = `/usr/bin/nmap $_GET[query]`;
+        break; 
+    }
+  }
+}
+
 $output = trim($output);
 echo("<pre>$output</pre>");
 
diff --git a/html/whois.php b/html/whois.php
deleted file mode 100644
index bf6b104cf2..0000000000
--- a/html/whois.php
+++ /dev/null
@@ -1,10 +0,0 @@
-<?php
-
-
-$output = `/usr/bin/whois $_GET[query] | grep -v \%`;
-
-$output = trim($output);
-
-echo("<pre>$output</pre>");
-
-?>