[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [BP][FIX] Fix scheduler injection

Elifeleti Mukisa Dan pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
5f46afd8 by Elifeleti Mukisa Dan at 2026-02-04T16:02:00+00:00
[BP][FIX] Fix scheduler injection
---
* [BP][FIX] Fix scheduler injection
---
* [BP][FIX] Fix scheduler injection
---
* [FIX] Fix scheduler injection
---
* [FIX] Fix scheduler injection

(cherry picked from commit ef49326b3ddc4424b438b1f3e1efc796e22944b9)

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!8503

See merge request tikiwiki/tiki!9496

See merge request tikiwiki/tiki!9497

See merge request tikiwiki/tiki!9500

- - - - -


2 changed files:

- lib/core/Scheduler/Task/HTTPGetCommandTask.php
- tiki-admin_schedulers.php


Changes:

=====================================
lib/core/Scheduler/Task/HTTPGetCommandTask.php
=====================================
@@ -103,4 +103,37 @@ class Scheduler_Task_HTTPGetCommandTask extends Scheduler_Task_CommandTask
             ],
         ];
     }
+    public function validateOutputFile($value): string | bool
+    {
+        // First validate the path
+        $publicPathes = [TEMP_PATH, HTTP_PUBLIC_PATH];
+
+        $pathDir = dirname($value);
+
+        foreach ($publicPathes as $dir) {
+            $realDir = realpath($dir);
+
+            if (strpos($pathDir, $realDir) === 0) {
+                return tra('You cannot write to this path.');
+            }
+        }
+
+        // After validate the file extension
+        $badExts = [
+            'php', 'phtml', 'phar',
+            'asp', 'aspx', 'jsp', 'cgi',
+            'pl', 'py', 'rb', 'sh',
+            'exe', 'dll', 'so', 'bin', 'msi',
+            'js', 'html', 'htm', 'svg', 'swf',
+            'cmd', 'bat', 'vbs', 'jar'
+        ];
+
+        $parts = explode('.', $value, 2);
+
+        if (count($parts) == 2 && in_array($parts[1], $badExts, true)) {
+            return tra('This extension is not allowed.');
+        }
+
+        return true;
+    }
 }


=====================================
tiki-admin_schedulers.php
=====================================
@@ -56,6 +56,16 @@ function saveScheduler()
                 $errors[] = sprintf(tra('%s is required'), $param['name']);
                 $addTask = false;
             }
+
+            $validateMethod = 'validate' . str_replace(' ', '', ucwords(str_replace('_', ' ', $key)));
+
+            if (method_exists($class, $validateMethod)) {
+                $validationResult = $class->$validateMethod($_POST[$httpParamName]);
+                if (is_string($validationResult)) {
+                    $errors[] = $validationResult;
+                    $addTask = false;
+                }
+            }
         }
 
         $params = $class->parseParams();



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/5f46afd8c18f44cbd9c3a2926b4c67d4918b8a30

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/5f46afd8c18f44cbd9c3a2926b4c67d4918b8a30
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs