Update method to POST + escapeshellarg()

ajax/networking/get_netcfg.php

@@ -3,11 +3,11 @@
 require '../../includes/csrf.php';
 require_once '../../includes/config.php';
 
-$interface = $_GET['iface'];
+$interface = $_POST['iface'];
 
 if (isset($interface)) {
     // fetch dnsmasq.conf settings for interface
-    exec('cat '. RASPI_DNSMASQ_PREFIX.$interface.'.conf', $return);
+    exec('cat '. RASPI_DNSMASQ_PREFIX.escapeshellarg($interface).'.conf', $return);
     $conf = ParseConfig($return);
 
     $dhcpdata['DHCPEnabled'] = empty($conf) ? false : true;

app/js/custom.js

@@ -178,8 +178,8 @@ Populates the DHCP server form fields
 Option toggles are set dynamically depending on the loaded configuration
 */
 function loadInterfaceDHCPSelect() {
-    var iface = $('#cbxdhcpiface').val();
-    $.get('ajax/networking/get_netcfg.php?iface='+iface,function(data){
+    var strInterface = $('#cbxdhcpiface').val();
+    $.post('ajax/networking/get_netcfg.php',{iface:strInterface},function(data){
         jsonData = JSON.parse(data);
         $('#dhcp-iface')[0].checked = jsonData.DHCPEnabled;
         $('#txtipaddress').val(jsonData.StaticIP);