kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-19 09:55:41 -07:00
Code Issues Packages Projects Releases Wiki Activity

ARI: Make ARI applications respect live_dangerously.

Browse Source 
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959
This commit is contained in:
George Joseph
2026-05-21 07:55:01 -06:00
committed by George Joseph
parent 0749d2a43e
commit 57a540d3d7
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/asterisk/stasis_app.h
+5
View File
@@ -631,6 +631,11 @@ int stasis_app_control_answer(struct stasis_app_control *control);
* \param variable The name of the variable
* \param value The value to set the variable to
*
* \note The thread that actually does the set will have the inhibit_escalations
* flag set before the call to pbx_builtin_setvar_helper to prevent dangerous
* dialplan function execution from ARI. The flag will be reset to its original
* state when pbx_builtin_setvar_helper returns.
*
* \return 0 for success.
* \return -1 for error.
*/
res/stasis/control.c
+10
View File
@@ -745,12 +745,22 @@ static int app_control_set_channel_var(struct stasis_app_control *control,
struct ast_channel *chan, void *data)
{
struct chanvar *var = data;
/*
* Save the current inhibit state then enable it.
*/
int inhibited = ast_thread_inhibit_escalations_swap(1);
if (ast_channel_set_ari_var_reportable(control->channel, var->name, var->report_events)) {
return -1;
}
pbx_builtin_setvar_helper(control->channel, var->name, var->value);
/*
* Re-enable it if it was originally enabled.
*/
if (inhibited > 0) {
ast_thread_inhibit_escalations();
}
return 0;
}