From cbc2757cea54268de9f54fc64fd59bd6bacd623a Mon Sep 17 00:00:00 2001
From: Neil Lathwood <neil@lathwood.co.uk>
Date: Wed, 18 Oct 2017 13:19:16 +0100
Subject: [PATCH] security: Stop accepting other variables in install that we
 do not use (#7511)

---
 html/install.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/html/install.php b/html/install.php
index ea0a9640a3..81c783665f 100644
--- a/html/install.php
+++ b/html/install.php
@@ -3,7 +3,12 @@ session_start();
 if (empty($_POST) && !empty($_SESSION) && !isset($_REQUEST['stage'])) {
     $_POST = $_SESSION;
 } elseif (!file_exists("../config.php")) {
-    $_SESSION = array_replace($_SESSION, $_POST);
+    $allowed_vars = array('stage','build-ok','dbhost','dbuser','dbpass','dbname','dbport','dbsocket','add_user','add_pass','add_email');
+    foreach ($allowed_vars as $allowed) {
+        if (isset($_POST[$allowed])) {
+            $_SESSION[$allowed] = $_POST[$allowed];
+        }
+    }
 }
 
 $stage = isset($_POST['stage']) ? $_POST['stage'] : 0;