svn: /web/doc-editor/trunk/php/ ExtJsController.php LockFile.php LogManager.php PreviewFile.php RepositoryFetcher.php

nbpoole                                  Thu, 23 Jun 2011 21:45:31 +0000

Revision: http://svn.php.net/viewvc?view=revision&revision=312416

Log:
Various security fixes.

Changed paths:
    U   web/doc-editor/trunk/php/ExtJsController.php
    U   web/doc-editor/trunk/php/LockFile.php
    U   web/doc-editor/trunk/php/LogManager.php
    U   web/doc-editor/trunk/php/PreviewFile.php
    U   web/doc-editor/trunk/php/RepositoryFetcher.php

Modified: web/doc-editor/trunk/php/ExtJsController.php
===================================================================
--- web/doc-editor/trunk/php/ExtJsController.php	2011-06-23 21:27:42 UTC (rev 312415)
+++ web/doc-editor/trunk/php/ExtJsController.php	2011-06-23 21:45:31 UTC (rev 312416)
@@ -313,6 +313,14 @@
             return JsonResponseBuilder::failure();
         }

+        if ( !$am->isGlobalAdmin() ) {
+            return JsonResponseBuilder::failure(
+                array(
+                    'type' => 'action_only_global_admin'
+                )
+            );
+        }
+
         $rm = RepositoryManager::getInstance();

         $project = $am->project;

Modified: web/doc-editor/trunk/php/LockFile.php
===================================================================
--- web/doc-editor/trunk/php/LockFile.php	2011-06-23 21:27:42 UTC (rev 312415)
+++ web/doc-editor/trunk/php/LockFile.php	2011-06-23 21:45:31 UTC (rev 312416)
@@ -23,6 +23,9 @@
         $am = AccountManager::getInstance();
         $appConf = $am->appConf;

+        // For security, we don't want to have IDs that can traverse directories.
+        $id = basename($id);
+
         $this->id   = $id;
         $this->path = $appConf['GLOBAL_CONFIGURATION']['data.path'] . '.' . $this->id;
     }
@@ -64,4 +67,4 @@
     }

 }
-?>
\ No newline at end of file
+?>

Modified: web/doc-editor/trunk/php/LogManager.php
===================================================================
--- web/doc-editor/trunk/php/LogManager.php	2011-06-23 21:27:42 UTC (rev 312415)
+++ web/doc-editor/trunk/php/LogManager.php	2011-06-23 21:45:31 UTC (rev 312416)
@@ -108,7 +108,7 @@
         $appConf = $am->appConf;
         $project = $am->project;

-        $fp = fopen($appConf[$project]['vcs.path'] . '../.' . $file, 'w');
+        $fp = fopen($appConf[$project]['vcs.path'] . '../.' . basename($file), 'w');
         fwrite($fp, implode("<br>",$output));
         fclose($fp);
     }
@@ -125,7 +125,7 @@
         $appConf = $am->appConf;
         $project = $am->project;

-        return $this->highlightBuildLog(file_get_contents($appConf[$project]['vcs.path'] . '../.' . $file));
+        return $this->highlightBuildLog(file_get_contents($appConf[$project]['vcs.path'] . '../.' . basename($file)));
     }

     /**

Modified: web/doc-editor/trunk/php/PreviewFile.php
===================================================================
--- web/doc-editor/trunk/php/PreviewFile.php	2011-06-23 21:27:42 UTC (rev 312415)
+++ web/doc-editor/trunk/php/PreviewFile.php	2011-06-23 21:45:31 UTC (rev 312416)
@@ -22,7 +22,7 @@
             return false;
         }

-        $this->path = $path;
+        $this->path = str_replace('..', '', $path);

         $this->checkPath();
         $this->makePreview();

Modified: web/doc-editor/trunk/php/RepositoryFetcher.php
===================================================================
--- web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-23 21:27:42 UTC (rev 312415)
+++ web/doc-editor/trunk/php/RepositoryFetcher.php	2011-06-23 21:45:31 UTC (rev 312416)
@@ -114,6 +114,10 @@

         $return = array();

+        if( !isset($appConf[$project]['skeletons.folder']) ) {
+            return $return;
+        }
+
         $dir = realpath($appConf[$project]['skeletons.folder']);
         $d = dir($dir);
         while (false !== ($entry = $d->read())) {