Update sanitize var method

RaspAP · Mar 29, 2023 · 7760a1d · 7760a1d
1 parent 1e52ff5
commit 7760a1d
Showing 1 changed file with 10 additions and 9 deletions.
diff --git a/includes/hostapd.php b/includes/hostapd.php
@@ -98,15 +98,16 @@ function DisplayHostAPDConfig()
         $arrConfig['country_code'] = $country_code[0];
     }
     // set txpower with iw if value is non-default ('auto')
-    $txpower = escapeshellarg($_POST['txpower']);
-    $interface = escapeshellarg($_POST['interface']);
-    if ($txpower) && ($txpower != 'auto')) {
-       $sdBm = $txpower * 100;
-        exec('sudo /sbin/iw dev '.$interface.' set txpower fixed '.$sdBm, $return);
-        $status->addMessage('Setting transmit power to '.$txpower.' dBm.', 'success');
-    } elseif ($txpower == 'auto') {
-        exec('sudo /sbin/iw dev '.$interface.' set txpower auto', $return);
-        $status->addMessage('Setting transmit power to '.$txpower.'.', 'success');
+    if (isset($_POST['txpower']) && ($_POST['txpower'] != 'auto')) {
+        $txpower = intval($_POST['txpower']);
+        $sdBm = $txpower * 100;
+        exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower fixed '.$sdBm, $return);
+        $status->addMessage('Setting transmit power to '.$_POST['txpower'].' dBm.', 'success');
+        $txpower = $_POST['txpower'];
+    } elseif ($_POST['txpower'] == 'auto') {
+        exec('sudo /sbin/iw dev '.escapeshellarg($_POST['interface']).' set txpower auto', $return);
+        $status->addMessage('Setting transmit power to '.$_POST['txpower'].'.', 'success');
+        $txpower = $_POST['txpower'];
     }
 
     $countries_5Ghz_max48ch = RASPI_5GHZ_ISO_ALPHA2;