lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security: Ajout test pour viter download fichier hors htdocs

Browse Source
This commit is contained in:
Laurent Destailleur 2007-04-12 19:47:50 +00:00
parent 84df8996d4
commit 61fafc43f4
2 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
htdocs/document.php
View File

@ -57,9 +57,9 @@ if (eregi('\.jpg$',$original_file)) { $type='image/jpeg'; $attachment = true; }
if (eregi('\.png$',$original_file)) { $type='image/jpeg'; $attachment = true; } if (eregi('\.png$',$original_file)) { $type='image/jpeg'; $attachment = true; }
if (eregi('\.tiff$',$original_file)) { $type='image/tiff'; $attachment = true; } if (eregi('\.tiff$',$original_file)) { $type='image/tiff'; $attachment = true; }
//Suppression de la chaine de caractère ../ dans $original_file // Suppression de la chaine de caractère ../ dans $original_file
$original_file = str_replace("../","/", "$original_file"); $original_file = str_replace("../","/", "$original_file");
# find the subdirectory name as the reference // find the subdirectory name as the reference
$refname=basename(dirname($original_file)."/"); $refname=basename(dirname($original_file)."/");
$accessallowed=0; $accessallowed=0;
@ -335,12 +335,25 @@ if ($user->societe_id>0)
} }
} }
// Security:
// Limite accès si droits non corrects // Limite accès si droits non corrects
if (! $accessallowed) if (! $accessallowed)
{ {
accessforbidden(); accessforbidden();
} }
// Security:
// On interdit les remontées de repertoire ainsi que les pipe dans
// les noms de fichiers.
if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file))
{
dolibarr_syslog("Refused to deliver file ".$original_file);
// Do no show plain path in shown error message
dolibarr_print_error(0,$langs->trans("ErrorFileNameInvalid",$_GET["file"]));
exit;
}
if ($action == 'remove_file') if ($action == 'remove_file')
{ {
@ -354,7 +367,7 @@ if ($action == 'remove_file')
if (! file_exists($original_file)) if (! file_exists($original_file))
{ {
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file)); dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"]));
exit; exit;
} }
unlink($original_file); unlink($original_file);

17
htdocs/viewimage.php
View File

@ -40,8 +40,6 @@ $original_file = urldecode($_GET["file"]);
$modulepart = urldecode($_GET["modulepart"]); $modulepart = urldecode($_GET["modulepart"]);
$type = urldecode($_GET["type"]); $type = urldecode($_GET["type"]);
$filename = basename ($original_file);
$accessallowed=0; $accessallowed=0;
if ($modulepart) if ($modulepart)
@ -229,12 +227,25 @@ if ($modulepart)
} }
// Security:
// Limite accès si droits non corrects // Limite accès si droits non corrects
if (! $accessallowed) if (! $accessallowed)
{ {
accessforbidden(); accessforbidden();
} }
// Security:
// On interdit les remontées de repertoire ainsi que les pipe dans
// les noms de fichiers.
if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file))
{
dolibarr_syslog("Refused to deliver file ".$original_file);
// Do no show plain path in shown error message
dolibarr_print_error(0,$langs->trans("ErrorFileNameInvalid",$_GET["file"]));
exit;
}
// Ouvre et renvoi fichier // Ouvre et renvoi fichier
clearstatcache(); clearstatcache();
@ -244,7 +255,7 @@ dolibarr_syslog("viewimage.php download $original_file $filename content-type=$t
if (! file_exists($original_file)) if (! file_exists($original_file))
{ {
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file)); dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"]));
exit; exit;
} }