Changeset 1838

Timestamp:

12/08/2011 11:25:14 PM (18 months ago)

Author:

BrianKoontz

Message:

Backported to 1.3.2-p6. Refs #1097, #1098, #1104.

Location:

branches/1.3.2

Files:

• actions/files/files.php (modified) (1 diff)
• version.php (modified) (1 diff)

branches/1.3.2/actions/files/files.php

@@ -188 +188 @@
 }
 
+// Sanitize filenames to prevent path traversal attacks
 $action = $this->GetSafeVar('action', 'get');
 $file = $this->GetSafeVar('file', 'get');
 $file_to_delete = $this->GetSafeVar('file_to_delete', 'post');
-$prohibited_filepath_tokens = "/^[\.\/\\\]/";
-if(preg_match($prohibited_filepath_tokens, $file) ||
-   preg_match($prohibited_filepath_tokens, $file_to_delete))
-{
-        $this->Redirect($this->Href(), T_("Sorry, files of this type are not allowed."));
-}
+
+$fileregex = "/^.*?([^\.\/\\\]+\.[A-Za-z0-9]{2,4})$/";
+if(isset($_GET['file']))
+{
+        $matches = '';
+        preg_match($fileregex, $file, $matches);
+        if(isset($matches[1]))
+                $file = $matches[1];
+        else
+                $this->Redirect('', T_("Invalid filename"));
+}
+if(isset($_POST['file_to_delete']))
+{
+        $matches = '';
+        preg_match($fileregex, $file_to_delete, $matches);
+        if(isset($matches[1]))
+                $file_to_delete = $matches[1];
+        else
+                $this->Redirect('', T_("Invalid filename"));
+}
+
 
 // 1a. User has requested a file to be deleted

branches/1.3.2/version.php

@@ -32 +32 @@
  * and does not need to be changed for major/minor releases.
  */
-if(!defined('WIKKA_PATCH_LEVEL')) define('WIKKA_PATCH_LEVEL', '4');
+if(!defined('WIKKA_PATCH_LEVEL')) define('WIKKA_PATCH_LEVEL', '6');
 ?>