svn: /web/doc-editor/trunk/php/ ExtJsController.php

yannick                                  Sun, 19 Jun 2011 22:35:37 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312310

Log:
Fix security issue - reported by Neal Poole

Changed paths:
    U   web/doc-editor/trunk/php/ExtJsController.php

Modified: web/doc-editor/trunk/php/ExtJsController.php
===================================================================
--- web/doc-editor/trunk/php/ExtJsController.php	2011-06-19 22:15:27 UTC (rev 312309)
+++ web/doc-editor/trunk/php/ExtJsController.php	2011-06-19 22:35:37 UTC (rev 312310)
@@ -667,7 +667,12 @@
      */
     public function getFile()
     {
-        AccountManager::getInstance()->isLogged();
+        $am = AccountManager::getInstance();
+
+        $am->isLogged();
+
+        $appConf = $am->appConf;
+        $project = $am->project;

         $FilePath = $this->getRequestVariable('FilePath');
         $FileName = $this->getRequestVariable('FileName');
@@ -690,6 +695,16 @@
         // Handle if we want to load a skeleton when we create a new file
         if( $skeleton )
         {
+            // Security fix
+            $skeleton = str_replace('..', '',  $skeleton);
+            // $skeleton is the ful path of the file
+            // It must start with this  : $appConf[$project]['skeletons.folder']
+
+            if( substr($skeleton, 0, strlen($appConf[$project]['skeletons.folder']) ) !=  $appConf[$project]['skeletons.folder'] ) {
+                return false;
+            }
+
+
             $return['content'] = ( $skeleton == '-' ) ? '' : file_get_contents($skeleton);
             $return['warn_tab'] = false;
             $return['warn_encoding'] = false;