Fix potential code injection on MAC address validator

[PromoFaux]

By submitting this pull request, I confirm the following:

• I have read and understood the contributors guide, as well as this entire template.
• I have made only one major change in my proposed changes.
• I have commented my proposed changes within the code.
• I have tested my proposed changes, and have included unit tests where possible.
• I am willing to help maintain this change if there are issues with it later.
• I give this submission freely and claim no ownership.
• It is compatible with the EUPL 1.2 license
• I have squashed any insignificant commits. (git rebase)

---

This is already fixed in release/v5.0, but pending that actually being pushed to master/released any time soon (though hopefully sooner rather than later)

I am proposing a 4.3.3 on the Web interface as an interim release.

Currently, I would say that this exploit is low risk, as it first requires an authenticated user to be logged into the web interface, really the most damage that can be done here is an admin messing up their own system.

[PromoFaux]

Thanks to @nate-red for pointing this out to us

[pralor-bot]

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/update-webinterface/28526/5

[iasdeoupxe]

CVE-2020-8816 seems got assigned for this issue:

https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/