webbuild-functions: filter web server REMOTE_* variables in cgi_getvars function for security

webbuild/webbuild-functions

@@ -136,6 +136,7 @@ function cgi_getvars()
         p=`echo $q | sed "s|&.*||"`
         q=`echo $q | sed "s|[^&]*&||"`
 	k="${p%%=*}"  # get the key (variable name) from it
+	[ "$k" = "REMOTE_ADDR" -o "$k" = "REMOTE_HOST" -o "$k" = "REMOTE_PORT" -o "$k" = "REMOTE_USER" ] && continue
 	v="${p#*=}"   # get the value from it
         # decode and evaluate var if requested
         if [ "$k" != "SPECTEXT" ]; then