lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security: Ajout test pour viter download fichier hors htdocs

Browse Source
This commit is contained in:
Laurent Destailleur 2007-04-12 19:47:50 +00:00
parent 84df8996d4
commit 61fafc43f4
2 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
htdocs/document.php
View File

@ -57,9 +57,9 @@ if (eregi('\.jpg$',$original_file)) { $type='image/jpeg'; $attachment = true; }
if (eregi('\.png$',$original_file)) { $type='image/jpeg'; $attachment = true; }
if (eregi('\.tiff$',$original_file)) { $type='image/tiff'; $attachment = true; }
//Suppression de la chaine de caractère ../ dans $original_file
// Suppression de la chaine de caractère ../ dans $original_file
$original_file = str_replace("../","/", "$original_file");
# find the subdirectory name as the reference
// find the subdirectory name as the reference
$refname=basename(dirname($original_file)."/");
$accessallowed=0;
@ -335,12 +335,25 @@ if ($user->societe_id>0)
}
}
// Security:
// Limite accès si droits non corrects
if (! $accessallowed)
{
accessforbidden();
}
// Security:
// On interdit les remontées de repertoire ainsi que les pipe dans
// les noms de fichiers.
if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file))
{
dolibarr_syslog("Refused to deliver file ".$original_file);
// Do no show plain path in shown error message
dolibarr_print_error(0,$langs->trans("ErrorFileNameInvalid",$_GET["file"]));
exit;
}
if ($action == 'remove_file')
{
@ -354,7 +367,7 @@ if ($action == 'remove_file')
if (! file_exists($original_file))
{
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file));
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"]));
exit;
}
unlink($original_file);

17
htdocs/viewimage.php
View File

@ -40,8 +40,6 @@ $original_file = urldecode($_GET["file"]);
$modulepart = urldecode($_GET["modulepart"]);
$type = urldecode($_GET["type"]);
$filename = basename ($original_file);
$accessallowed=0;
if ($modulepart)
@ -229,12 +227,25 @@ if ($modulepart)
}
// Security:
// Limite accès si droits non corrects
if (! $accessallowed)
{
accessforbidden();
}
// Security:
// On interdit les remontées de repertoire ainsi que les pipe dans
// les noms de fichiers.
if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file))
{
dolibarr_syslog("Refused to deliver file ".$original_file);
// Do no show plain path in shown error message
dolibarr_print_error(0,$langs->trans("ErrorFileNameInvalid",$_GET["file"]));
exit;
}
// Ouvre et renvoi fichier
clearstatcache();
@ -244,7 +255,7 @@ dolibarr_syslog("viewimage.php download $original_file $filename content-type=$t
if (! file_exists($original_file))
{
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file));
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"]));
exit;
}