svn: /web/doc-editor/trunk/php/ ExtJsController.php RepositoryFetcher.php

yannick                                  Sun, 19 Jun 2011 22:40:13 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312311

Log:
Fix security issue - reported by Neal Poole

Changed paths:
    U   web/doc-editor/trunk/php/ExtJsController.php
    U   web/doc-editor/trunk/php/RepositoryFetcher.php

Modified: web/doc-editor/trunk/php/ExtJsController.php
===================================================================
--- web/doc-editor/trunk/php/ExtJsController.php	2011-06-19 22:35:37 UTC (rev 312310)
+++ web/doc-editor/trunk/php/ExtJsController.php	2011-06-19 22:40:13 UTC (rev 312311)
@@ -1554,15 +1554,18 @@
      */
     public function getAllFiles()
     {
-        AccountManager::getInstance()->isLogged();
+        $am = AccountManager::getInstance();
+        $rf = RepositoryFetcher::getInstance();
+
+        $am->isLogged();

         $node   = $this->getRequestVariable('node');
         $search = $this->getRequestVariable('search');

         if ($this->hasRequestVariable('search')) {
-            $files = RepositoryFetcher::getInstance()->getFileByKeyword($search);
+            $files = $rf->getFileByKeyword($search);
         } else {
-            $files = RepositoryFetcher::getInstance()->getFilesByDirectory($node);
+            $files = $rf->getFilesByDirectory($node);
         }

         return JsonResponseBuilder::response($files);

Modified: web/doc-editor/trunk/php/RepositoryFetcher.php
===================================================================
--- web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-19 22:35:37 UTC (rev 312310)
+++ web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-19 22:40:13 UTC (rev 312311)
@@ -1150,6 +1150,11 @@

         $m = $this->getModifies();

+        // Test if this dir exist
+        if( !is_dir($appConf[$project]['vcs.path'].$dir) ) {
+            return;
+        }
+
         $d = dir($appConf[$project]['vcs.path'].$dir);

         $files = array();