[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Fix scheduler injection

Elifeleti Mukisa Dan pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
866307a0 by Elifeleti Mukisa Dan at 2025-09-04T12:33:41+00:00
[FIX] Fix scheduler injection
---
* [FIX] Fix scheduler injection


(cherry picked from commit ef49326b3ddc4424b438b1f3e1efc796e22944b9)

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!8503

- - - - -


2 changed files:

- lib/core/Scheduler/Task/HTTPGetCommandTask.php
- tiki-admin_schedulers.php


Changes:

=====================================
lib/core/Scheduler/Task/HTTPGetCommandTask.php
=====================================
@@ -103,4 +103,37 @@ class Scheduler_Task_HTTPGetCommandTask extends Scheduler_Task_CommandTask
             ],
         ];
     }
+    public function validateOutputFile($value): string | bool
+    {
+        // First validate the path
+        $publicPathes = [TEMP_PATH, HTTP_PUBLIC_PATH];
+
+        $pathDir = dirname($value);
+
+        foreach ($publicPathes as $dir) {
+            $realDir = realpath($dir);
+
+            if (strpos($pathDir, $realDir) === 0) {
+                return tra('You cannot write to this path.');
+            }
+        }
+
+        // After validate the file extension
+        $badExts = [
+            'php', 'phtml', 'phar',
+            'asp', 'aspx', 'jsp', 'cgi',
+            'pl', 'py', 'rb', 'sh',
+            'exe', 'dll', 'so', 'bin', 'msi',
+            'js', 'html', 'htm', 'svg', 'swf',
+            'cmd', 'bat', 'vbs', 'jar'
+        ];
+
+        $parts = explode('.', $value, 2);
+
+        if (count($parts) == 2 && in_array($parts[1], $badExts, true)) {
+            return tra('This extension is not allowed.');
+        }
+
+        return true;
+    }
 }


=====================================
tiki-admin_schedulers.php
=====================================
@@ -25,6 +25,8 @@ $inputConfiguration = [
             'logs'                       => 'string',         //post
             'add'                        => 'bool',           //post
             'filter'                     => 'string',         //get
+            'url'                        => 'url',            //post
+            'output_file'                => 'purifier'        //post
         ],
     ],
 ];
@@ -86,6 +88,16 @@ function saveScheduler()
                 $errors[] = sprintf(tra('%s is required'), $param['name']);
                 $addTask = false;
             }
+
+            $validateMethod = 'validate' . str_replace(' ', '', ucwords(str_replace('_', ' ', $key)));
+
+            if (method_exists($class, $validateMethod)) {
+                $validationResult = $class->$validateMethod($_POST[$httpParamName]);
+                if (is_string($validationResult)) {
+                    $errors[] = $validationResult;
+                    $addTask = false;
+                }
+            }
         }
 
         $params = $class->parseParams();



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/866307a07e0cbf6c18e9c07d12a4519e3826bcaa

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/866307a07e0cbf6c18e9c07d12a4519e3826bcaa
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs