From bf771eda5f2175d4ba24376ebf91ecaafde25c48 Mon Sep 17 00:00:00 2001
From: shortcutme <tamas@zeronet.io>
Date: Wed, 28 Aug 2019 01:33:32 +0200
Subject: [PATCH] Restrict setting open_browser values in config file

---
 src/Ui/UiWebsocket.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/Ui/UiWebsocket.py b/src/Ui/UiWebsocket.py
index b407e597..580ff2af 100644
--- a/src/Ui/UiWebsocket.py
+++ b/src/Ui/UiWebsocket.py
@@ -1120,6 +1120,11 @@ class UiWebsocket(object):
             self.response(to, {"error": "Forbidden you cannot set this config key"})
             return
 
+        if key == "open_browser":
+            if value not in ["default_browser", "False"]:
+                self.response(to, {"error": "Forbidden: Invalid value"})
+                return
+
         # Remove empty lines from lists
         if type(value) is list:
             value = [line for line in value if line]