aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB
diff options
context:
space:
mode:
authorNils Adermann <naderman@naderman.de>2013-04-24 09:45:34 -0700
committerNils Adermann <naderman@naderman.de>2013-04-24 09:45:34 -0700
commit3e32655c7f22ce9aff7bafdbab6d556879b5fcf9 (patch)
tree20853ed2664b6e28d5a2f42ee94ab8418b689629 /phpBB
parentab628cbdb99eda1c3efbbca7e374f64876800428 (diff)
parent16e70fa08610227d96e149eba2019803ad37c85f (diff)
downloadforums-3e32655c7f22ce9aff7bafdbab6d556879b5fcf9.tar
forums-3e32655c7f22ce9aff7bafdbab6d556879b5fcf9.tar.gz
forums-3e32655c7f22ce9aff7bafdbab6d556879b5fcf9.tar.bz2
forums-3e32655c7f22ce9aff7bafdbab6d556879b5fcf9.tar.xz
forums-3e32655c7f22ce9aff7bafdbab6d556879b5fcf9.zip
Merge pull request #1290 from nickvergessen/ticket/11362
Correctly sanitise the directory path in finder
Diffstat (limited to 'phpBB')
-rw-r--r--phpBB/common.php5
-rw-r--r--phpBB/config/services.yml5
-rw-r--r--phpBB/includes/extension/finder.php7
-rw-r--r--phpBB/includes/extension/manager.php6
-rw-r--r--phpBB/includes/filesystem.php52
-rw-r--r--phpBB/includes/functions.php34
6 files changed, 88 insertions, 21 deletions
diff --git a/phpBB/common.php b/phpBB/common.php
index c33e2cbb1f..6dd65739fc 100644
--- a/phpBB/common.php
+++ b/phpBB/common.php
@@ -44,8 +44,11 @@ if (!defined('PHPBB_INSTALLED'))
// Replace any number of consecutive backslashes and/or slashes with a single slash
// (could happen on some proxy setups and/or Windows servers)
$script_path = preg_replace('#[\\\\/]{2,}#', '/', $script_path);
+
// Eliminate . and .. from the path
- $script_path = phpbb_clean_path($script_path);
+ require($phpbb_root_path . 'includes/filesystem.' . $phpEx);
+ $phpbb_filesystem = new phpbb_filesystem();
+ $script_path = $phpbb_filesystem->clean_path($script_path);
$url = (($secure) ? 'https://' : 'http://') . $server_name;
diff --git a/phpBB/config/services.yml b/phpBB/config/services.yml
index b9c71844dc..19dfb3e23b 100644
--- a/phpBB/config/services.yml
+++ b/phpBB/config/services.yml
@@ -131,6 +131,7 @@ services:
- @dbal.conn
- @config
- @migrator
+ - @filesystem
- %tables.ext%
- %core.root_path%
- .%core.php_ext%
@@ -140,11 +141,15 @@ services:
class: phpbb_extension_finder
arguments:
- @ext.manager
+ - @filesystem
- %core.root_path%
- @cache.driver
- .%core.php_ext%
- _ext_finder
+ filesystem:
+ class: phpbb_filesystem
+
groupposition.legend:
class: phpbb_groupposition_legend
arguments:
diff --git a/phpBB/includes/extension/finder.php b/phpBB/includes/extension/finder.php
index f71e32bc8d..02a9ebb8c3 100644
--- a/phpBB/includes/extension/finder.php
+++ b/phpBB/includes/extension/finder.php
@@ -23,6 +23,7 @@ if (!defined('IN_PHPBB'))
class phpbb_extension_finder
{
protected $extension_manager;
+ protected $filesystem;
protected $phpbb_root_path;
protected $cache;
protected $php_ext;
@@ -54,15 +55,17 @@ class phpbb_extension_finder
* @param phpbb_extension_manager $extension_manager An extension manager
* instance that provides the finder with a list of active
* extensions and their locations
+ * @param phpbb_filesystem $filesystem Filesystem instance
* @param string $phpbb_root_path Path to the phpbb root directory
* @param phpbb_cache_driver_interface $cache A cache instance or null
* @param string $php_ext php file extension
* @param string $cache_name The name of the cache variable, defaults to
* _ext_finder
*/
- public function __construct(phpbb_extension_manager $extension_manager, $phpbb_root_path = '', phpbb_cache_driver_interface $cache = null, $php_ext = '.php', $cache_name = '_ext_finder')
+ public function __construct(phpbb_extension_manager $extension_manager, phpbb_filesystem $filesystem, $phpbb_root_path = '', phpbb_cache_driver_interface $cache = null, $php_ext = '.php', $cache_name = '_ext_finder')
{
$this->extension_manager = $extension_manager;
+ $this->filesystem = $filesystem;
$this->phpbb_root_path = $phpbb_root_path;
$this->cache = $cache;
$this->php_ext = $php_ext;
@@ -227,7 +230,7 @@ class phpbb_extension_finder
*/
protected function sanitise_directory($directory)
{
- $directory = preg_replace('#(?:^|/)\./#', '/', $directory);
+ $directory = $this->filesystem->clean_path($directory);
$dir_len = strlen($directory);
if ($dir_len > 1 && $directory[$dir_len - 1] === '/')
diff --git a/phpBB/includes/extension/manager.php b/phpBB/includes/extension/manager.php
index 44a30c6280..de9a3937c3 100644
--- a/phpBB/includes/extension/manager.php
+++ b/phpBB/includes/extension/manager.php
@@ -44,13 +44,14 @@ class phpbb_extension_manager
* @param phpbb_db_driver $db A database connection
* @param phpbb_config $config phpbb_config
* @param phpbb_db_migrator $migrator
+ * @param phpbb_filesystem $filesystem
* @param string $extension_table The name of the table holding extensions
* @param string $phpbb_root_path Path to the phpbb includes directory.
* @param string $php_ext php file extension
* @param phpbb_cache_driver_interface $cache A cache instance or null
* @param string $cache_name The name of the cache variable, defaults to _ext
*/
- public function __construct(ContainerInterface $container, phpbb_db_driver $db, phpbb_config $config, phpbb_db_migrator $migrator, $extension_table, $phpbb_root_path, $php_ext = '.php', phpbb_cache_driver_interface $cache = null, $cache_name = '_ext')
+ public function __construct(ContainerInterface $container, phpbb_db_driver $db, phpbb_config $config, phpbb_db_migrator $migrator, phpbb_filesystem $filesystem, $extension_table, $phpbb_root_path, $php_ext = '.php', phpbb_cache_driver_interface $cache = null, $cache_name = '_ext')
{
$this->container = $container;
$this->phpbb_root_path = $phpbb_root_path;
@@ -58,6 +59,7 @@ class phpbb_extension_manager
$this->config = $config;
$this->migrator = $migrator;
$this->cache = $cache;
+ $this->filesystem = $filesystem;
$this->php_ext = $php_ext;
$this->extension_table = $extension_table;
$this->cache_name = $cache_name;
@@ -510,7 +512,7 @@ class phpbb_extension_manager
*/
public function get_finder()
{
- return new phpbb_extension_finder($this, $this->phpbb_root_path, $this->cache, $this->php_ext, $this->cache_name . '_finder');
+ return new phpbb_extension_finder($this, $this->filesystem, $this->phpbb_root_path, $this->cache, $this->php_ext, $this->cache_name . '_finder');
}
/**
diff --git a/phpBB/includes/filesystem.php b/phpBB/includes/filesystem.php
new file mode 100644
index 0000000000..27cab48fb0
--- /dev/null
+++ b/phpBB/includes/filesystem.php
@@ -0,0 +1,52 @@
+<?php
+/**
+*
+* @package phpBB3
+* @copyright (c) 2013 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+ exit;
+}
+
+/**
+* A class with various functions that are related to paths, files and the filesystem
+* @package phpBB3
+*/
+class phpbb_filesystem
+{
+ /**
+ * Eliminates useless . and .. components from specified path.
+ *
+ * @param string $path Path to clean
+ * @return string Cleaned path
+ */
+ public function clean_path($path)
+ {
+ $exploded = explode('/', $path);
+ $filtered = array();
+ foreach ($exploded as $part)
+ {
+ if ($part === '.' && !empty($filtered))
+ {
+ continue;
+ }
+
+ if ($part === '..' && !empty($filtered) && $filtered[sizeof($filtered) - 1] !== '..')
+ {
+ array_pop($filtered);
+ }
+ else
+ {
+ $filtered[] = $part;
+ }
+ }
+ $path = implode('/', $filtered);
+ return $path;
+ }
+}
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 58d2ad4760..05a278a2b4 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -1049,31 +1049,33 @@ else
/**
* Eliminates useless . and .. components from specified path.
*
+* Deprecated, use filesystem class instead
+*
* @param string $path Path to clean
* @return string Cleaned path
+*
+* @deprecated
*/
function phpbb_clean_path($path)
{
- $exploded = explode('/', $path);
- $filtered = array();
- foreach ($exploded as $part)
- {
- if ($part === '.' && !empty($filtered))
- {
- continue;
- }
+ global $phpbb_container;
- if ($part === '..' && !empty($filtered) && $filtered[sizeof($filtered) - 1] !== '..')
- {
- array_pop($filtered);
- }
- else
+ if ($phpbb_container)
+ {
+ $phpbb_filesystem = $phpbb_container->get('filesystem');
+ }
+ else
+ {
+ // The container is not yet loaded, use a new instance
+ if (!class_exists('phpbb_filesystem'))
{
- $filtered[] = $part;
+ global $phpbb_root_path, $phpEx;
+ require($phpbb_root_path . 'includes/filesystem.' . $phpEx);
}
+ $phpbb_filesystem = new phpbb_filesystem();
}
- $path = implode('/', $filtered);
- return $path;
+
+ return $phpbb_filesystem->clean_path($path);
}
// functions used for building option fields
generated by cgit v1.2.1 (git 2.21.0) at 2024-11-22 21:31:31 +0000