lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #6444

Browse Source
This commit is contained in:
Laurent Destailleur 2017-03-10 14:08:53 +01:00
parent fbbcec2ba3
commit 277fa7dbe1
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/core/lib/files.lib.php
View File

@ -1139,6 +1139,7 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
* @param int $nohook Disable all hooks * @param int $nohook Disable all hooks
* @param object $object Current object in use * @param object $object Current object in use
* @return boolean True if no error (file is deleted or if glob is used and there's nothing to delete), False if error * @return boolean True if no error (file is deleted or if glob is used and there's nothing to delete), False if error
* @see dol_delete_dir
*/ */
function dol_delete_file($file,$disableglob=0,$nophperrors=0,$nohook=0,$object=null) function dol_delete_file($file,$disableglob=0,$nophperrors=0,$nohook=0,$object=null)
{ {
@ -1151,8 +1152,8 @@ function dol_delete_file($file,$disableglob=0,$nophperrors=0,$nohook=0,$object=n
dol_syslog("dol_delete_file file=".$file." disableglob=".$disableglob." nophperrors=".$nophperrors." nohook=".$nohook); dol_syslog("dol_delete_file file=".$file." disableglob=".$disableglob." nophperrors=".$nophperrors." nohook=".$nohook);
// Security: // Security:
// We refuse cache files/dirs, upload using .. and pipes into filenames. // We refuse transversal using .. and pipes into filenames.
if (preg_match('/^\./',$file) || preg_match('/\.\./',$file) || preg_match('/[<>|]/',$file)) if (preg_match('/\.\./',$file) || preg_match('/[<>|]/',$file))
{ {
dol_syslog("Refused to delete file ".$file, LOG_WARNING); dol_syslog("Refused to delete file ".$file, LOG_WARNING);
return False; return False;
@ -1222,9 +1223,18 @@ function dol_delete_file($file,$disableglob=0,$nophperrors=0,$nohook=0,$object=n
* @param string $dir Directory to delete * @param string $dir Directory to delete
* @param int $nophperrors Disable all PHP output errors * @param int $nophperrors Disable all PHP output errors
* @return boolean True if success, false if error * @return boolean True if success, false if error
* @see dol_delete_file
*/ */
function dol_delete_dir($dir,$nophperrors=0) function dol_delete_dir($dir,$nophperrors=0)
{ {
// Security:
// We refuse transversal using .. and pipes into filenames.
if (preg_match('/\.\./',$dir) || preg_match('/[<>|]/',$dir))
{
dol_syslog("Refused to delete dir ".$dir, LOG_WARNING);
return False;
}
$dir_osencoded=dol_osencode($dir); $dir_osencoded=dol_osencode($dir);
return ($nophperrors?@rmdir($dir_osencoded):rmdir($dir_osencoded)); return ($nophperrors?@rmdir($dir_osencoded):rmdir($dir_osencoded));
} }