diff --git a/doc/UPGRADE-staging/AMI-Originate.txt b/doc/UPGRADE-staging/AMI-Originate.txt new file mode 100644 index 0000000000000000000000000000000000000000..f2d3133098f762a4529fd14b7deff27481852d28 --- /dev/null +++ b/doc/UPGRADE-staging/AMI-Originate.txt @@ -0,0 +1,5 @@ +Subject: AMI + +The AMI Originate action, which optionally takes a dialplan application as +an argument, no longer accepts "Originate" as the application due to +security concerns. diff --git a/main/manager.c b/main/manager.c index dd099c54414226c5dacaf5eacf372cf3d6452cc5..2d6897c5b3165a03eac083d1861a3c3954ab4306 100644 --- a/main/manager.c +++ b/main/manager.c @@ -5744,6 +5744,7 @@ static int action_originate(struct mansession *s, const struct message *m) EAGI(/bin/rm,-rf /) */ strcasestr(app, "mixmonitor") || /* MixMonitor(blah,,rm -rf) */ strcasestr(app, "externalivr") || /* ExternalIVR(rm -rf) */ + strcasestr(app, "originate") || /* Originate(Local/1234,app,System,rm -rf) */ (strstr(appdata, "SHELL") && (bad_appdata = 1)) || /* NoOp(${SHELL(rm -rf /)}) */ (strstr(appdata, "EVAL") && (bad_appdata = 1)) /* NoOp(${EVAL(${some_var_containing_SHELL})}) */ )) {