lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix rename of file to remove .noexe extension.

Browse Source
This commit is contained in:
Laurent Destailleur 2017-06-18 21:52:51 +02:00
parent abe736c6a6
commit 0ef507ae7f
3 changed files with 37 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
htdocs/comm/propal/document.php
View File

@ -1,6 +1,6 @@
<?php <?php
/* Copyright (C) 2003-2004 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2003-2004 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2009 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com> * Copyright (C) 2005 Marc Barilley / Ocebo <marc@ocebo.com>
* Copyright (C) 2005-2012 Regis Houssin <regis.houssin@capnetworks.com> * Copyright (C) 2005-2012 Regis Houssin <regis.houssin@capnetworks.com>
* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr> * Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
@ -63,17 +63,18 @@ if (! $sortfield) $sortfield="name";
$object = new Propal($db); $object = new Propal($db);
$object->fetch($id,$ref); $object->fetch($id,$ref);
if ($object->id > 0)
{
$object->fetch_thirdparty();
$upload_dir = $conf->propal->dir_output.'/'.dol_sanitizeFileName($object->ref);
include_once DOL_DOCUMENT_ROOT . '/core/actions_linkedfiles.inc.php';
}
/* /*
* Actions * Actions
*/ */
if ($object->id > 0)
{
$object->fetch_thirdparty();
$upload_dir = $conf->propal->dir_output.'/'.dol_sanitizeFileName($object->ref);
include_once DOL_DOCUMENT_ROOT . '/core/actions_linkedfiles.inc.php';
}
/* /*

9
htdocs/core/actions_linkedfiles.inc.php
View File

@ -150,6 +150,15 @@ elseif ($action == 'renamefile' && GETPOST('renamefilesave'))
{ {
$filenamefrom=dol_sanitizeFileName(GETPOST('renamefilefrom')); $filenamefrom=dol_sanitizeFileName(GETPOST('renamefilefrom'));
$filenameto=dol_sanitizeFileName(GETPOST('renamefileto')); $filenameto=dol_sanitizeFileName(GETPOST('renamefileto'));
// Security:
// Disallow file with some extensions. We rename them.
// Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.
if (preg_match('/\.htm|\.html|\.php|\.pl|\.cgi$/i',$filenameto) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED))
{
$filenameto.= '.noexe';
}
if ($filenamefrom && $filenameto) if ($filenamefrom && $filenameto)
{ {
$srcpath = $upload_dir.'/'.$filenamefrom; $srcpath = $upload_dir.'/'.$filenamefrom;

6
htdocs/core/lib/files.lib.php
View File

@ -634,9 +634,9 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
} }
} }
// Security: // Security:
// Disallow file with some extensions. We renamed them. // Disallow file with some extensions. We rename them.
// Car si on a mis le rep documents dans un rep de la racine web (pas bien), cela permet d'executer du code a la demande. // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.
if (preg_match('/\.htm|\.html|\.php|\.pl|\.cgi$/i',$dest_file) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED)) if (preg_match('/\.htm|\.html|\.php|\.pl|\.cgi$/i',$dest_file) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED))
{ {
$file_name.= '.noexe'; $file_name.= '.noexe';