Skip to content
This repository was archived by the owner on Nov 15, 2024. It is now read-only.

Commit a50cac8

Browse files
trippotrippo
committed
version 9.13.4
- fix Directory Traversal Allows to Read Any File (thanks to Simon Uvarov for reporting) - fix Path Traversal While Upacking Archives (thanks to Simon Uvarov for reporting) - Fix foreach warning on URL upload - Fix http https URL upload - add toggle on config for extract_files - prevent image creation for broken links in URL upload (thanks to davodavodavo3) - Migrate to yarn on development (thanks to mklkj) - code refactoring
1 parent 15a571b commit a50cac8

File tree

10 files changed

+133
-93
lines changed

10 files changed

+133
-93
lines changed

‎changelog.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
11
Responsive Filemanager Changelog
22

3+
*********************************************************
4+
* RFM 9.13.4
5+
*********************************************************
6+
- fix Directory Traversal Allows to Read Any File (thanks to Simon Uvarov for reporting)
7+
- fix Path Traversal While Upacking Archives (thanks to Simon Uvarov for reporting)
8+
- Fix foreach warning on URL upload
9+
- Fix http https URL upload
10+
- add toggle on config for extract_files
11+
- prevent image creation for broken links in URL upload (thanks to davodavodavo3)
12+
- Migrate to yarn on development (thanks to mklkj)
13+
- code refactoring
14+
15+
16+
317
*********************************************************
418
* RFM 9.13.3
519
*********************************************************

‎filemanager/ajax_calls.php‎

Lines changed: 34 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,21 @@
2323
response(trans('Lang_Not_Found').AddErrorLocation())->send();
2424
exit;
2525
}
26+
27+
28+
//check $_GET['file']
29+
if(isset($_GET['file']) && !checkRelativePath($_GET['file'])) {
30+
response(trans('wrong path'))->send();
31+
exit;
32+
}
33+
34+
//check $_GET['file']
35+
if(isset($_GET['path']) && !checkRelativePath($_GET['path'])) {
36+
response(trans('wrong path'))->send();
37+
exit;
38+
}
39+
40+
2641
$ftp = ftp_con($config);
2742

2843
if(isset($_GET['action']))
@@ -83,12 +98,7 @@
8398
case 'save_img':
8499
$info = pathinfo($_POST['name']);
85100

86-
if (
87-
strpos($_POST['path'], '/') === 0
88-
|| strpos($_POST['path'], '../') !== false
89-
|| strpos($_POST['path'], '..\\') !== false
90-
|| strpos($_POST['path'], './') === 0
91-
|| (strpos($_POST['url'], 'http://s3.amazonaws.com/feather') !== 0 && strpos($_POST['url'], 'https://s3.amazonaws.com/feather') !== 0)
101+
if ((strpos($_POST['url'], 'http://s3.amazonaws.com/feather') !== 0 && strpos($_POST['url'], 'https://s3.amazonaws.com/feather') !== 0)
92102
|| $_POST['name'] != fix_filename($_POST['name'], $config)
93103
|| ! in_array(strtolower($info['extension']), array( 'jpg', 'jpeg', 'png' ))
94104
)
@@ -135,15 +145,9 @@
135145
}
136146
break;
137147
case 'extract':
138-
if ( strpos($_POST['path'], '/') === 0
139-
|| strpos($_POST['path'], '../') !== false
140-
|| strpos($_POST['path'], '..\\') !== false
141-
|| strpos($_POST['path'], './') === 0)
142-
{
143-
response(trans('wrong path'.AddErrorLocation()))->send();
144-
exit;
148+
if(!$config['extract_files']){
149+
response(trans('wrong action'))->send();
145150
}
146-
147151
if($ftp){
148152
$path = $config['ftp_base_url'].$config['upload_dir'] . $_POST['path'];
149153
$base_folder = $config['ftp_base_url'].$config['upload_dir'] . fix_dirname($_POST['path']) . "/";
@@ -186,28 +190,24 @@
186190
exit;
187191
}
188192

189-
//make all the folders
190-
for ($i = 0; $i < $zip->numFiles; $i++)
191-
{
192-
$OnlyFileName = $zip->getNameIndex($i);
193-
$FullFileName = $zip->statIndex($i);
194-
if (substr($FullFileName['name'], -1, 1) == "/")
195-
{
196-
create_folder($base_folder . $FullFileName['name']);
197-
}
198-
}
199-
//unzip into the folders
193+
//make all the folders and unzip into the folders
200194
for ($i = 0; $i < $zip->numFiles; $i++)
201195
{
202-
$OnlyFileName = $zip->getNameIndex($i);
203196
$FullFileName = $zip->statIndex($i);
204197

205-
if ( ! (substr($FullFileName['name'], -1, 1) == "/"))
206-
{
207-
$fileinfo = pathinfo($OnlyFileName);
208-
if (in_array(strtolower($fileinfo['extension']), $config['ext']))
198+
if(checkRelativePath($FullFileName['name'])){
199+
if (substr($FullFileName['name'], -1, 1) == "/")
209200
{
210-
copy('zip://' . $path . '#' . $OnlyFileName, $base_folder . $FullFileName['name']);
201+
create_folder($base_folder . $FullFileName['name']);
202+
}
203+
204+
if ( ! (substr($FullFileName['name'], -1, 1) == "/"))
205+
{
206+
$fileinfo = pathinfo($FullFileName['name']);
207+
if (in_array(strtolower($fileinfo['extension']), $config['ext']))
208+
{
209+
copy('zip://' . $path . '#' . $FullFileName['name'], $base_folder . $FullFileName['name']);
210+
}
211211
}
212212
}
213213
}
@@ -232,7 +232,7 @@
232232
$phar = new PharData($path);
233233
$phar->decompressFiles();
234234
$files = array();
235-
check_files_extensions_on_phar($phar, $files, '', $config['ext']);
235+
check_files_extensions_on_phar($phar, $files, '', $config);
236236
$phar->extractTo($base_folder, $files, true);
237237

238238
break;
@@ -365,16 +365,7 @@
365365
case 'copy_cut':
366366
if ($_POST['sub_action'] != 'copy' && $_POST['sub_action'] != 'cut')
367367
{
368-
response(trans('wrong sub-action').AddErrorLocation())->send();
369-
exit;
370-
}
371-
372-
if (strpos($_POST['path'],'../') !== FALSE
373-
|| strpos($_POST['path'],'./') !== FALSE
374-
|| strpos($_POST['path'],'..\\') !== FALSE
375-
|| strpos($_POST['path'],'.\\') !== FALSE )
376-
{
377-
response(trans('wrong path'.AddErrorLocation()))->send();
368+
response(trans('wrong sub-action'))->send();
378369
exit;
379370
}
380371

@@ -611,7 +602,7 @@
611602

612603
if ($sub_action != 'preview' && $sub_action != 'edit')
613604
{
614-
response(trans('wrong action').AddErrorLocation())->send();
605+
response(trans('wrong action'))->send();
615606
exit;
616607
}
617608

‎filemanager/config/config.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,7 @@
329329
'rename_files' => true,
330330
'rename_folders' => true,
331331
'duplicate_files' => true,
332+
'extract_files' => true,
332333
'copy_cut_files' => true, // for copy/cut files
333334
'copy_cut_dirs' => true, // for copy/cut directories
334335
'chmod_files' => true, // change file permissions

‎filemanager/dialog.php‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,8 @@
4747
}elseif(isset($_SESSION['RF']['fldr']) && !empty($_SESSION['RF']['fldr'])){
4848
$subdir_path = rawurldecode(trim(strip_tags($_SESSION['RF']['fldr']),"/"));
4949
}
50-
$subdir_path_decoded = urldecode($subdir_path);
51-
if (strpos($subdir_path,'../') === FALSE
52-
&& strpos($subdir_path,'./') === FALSE
53-
&& strpos($subdir_path,'..\\') === FALSE
54-
&& strpos($subdir_path,'.\\') === FALSE
55-
&& strpos($subdir_path_decoded,'../') === FALSE
56-
&& strpos($subdir_path_decoded,'./') === FALSE
57-
&& strpos($subdir_path_decoded,'..\\') === FALSE
58-
&& strpos($subdir_path_decoded,'.\\') === FALSE)
50+
51+
if ( checkRelativePath($subdir_path))
5952
{
6053
$subdir = strip_tags($subdir_path) ."/";
6154
$_SESSION['RF']['fldr'] = $subdir_path;
@@ -99,9 +92,10 @@
9992
}
10093
$rfm_subfolder = '';
10194

102-
if (!empty($_SESSION['RF']["subfolder"]) && strpos($_SESSION['RF']["subfolder"],'../') === FALSE && strpos($_SESSION['RF']["subfolder"],'..\\') === FALSE
103-
&& strpos($_SESSION['RF']["subfolder"],'./') === FALSE && strpos($_SESSION['RF']["subfolder"],"/") !== 0
104-
&& strpos($_SESSION['RF']["subfolder"],'.') === FALSE)
95+
if (!empty($_SESSION['RF']["subfolder"])
96+
&& strpos($_SESSION['RF']["subfolder"],"/") !== 0
97+
&& strpos($_SESSION['RF']["subfolder"],'.') === FALSE
98+
)
10599
{
106100
$rfm_subfolder = $_SESSION['RF']['subfolder'];
107101
}
@@ -257,7 +251,7 @@
257251
$ext_tmp = array();
258252
foreach($extensions as $extension){
259253
$extension = fix_strtolower($extension);
260-
if(in_array( $extension, $config['ext'])){
254+
if(check_file_extension( $extension, $config)){
261255
$ext_tmp[]=$extension;
262256
}
263257
}
@@ -482,6 +476,7 @@
482476
<input type="hidden" id="lang_error_upload" value="<?php echo trans('Error_Upload');?>" />
483477
<input type="hidden" id="lang_select" value="<?php echo trans('Select');?>" />
484478
<input type="hidden" id="lang_extract" value="<?php echo trans('Extract');?>" />
479+
<input type="hidden" id="extract_files" value="<?php if($config['extract_files']) echo 1; else echo 0;?>" />
485480
<input type="hidden" id="transliteration" value="<?php echo $config['transliteration']?"true":"false";?>" />
486481
<input type="hidden" id="convert_spaces" value="<?php echo $config['convert_spaces']?"true":"false";?>" />
487482
<input type="hidden" id="replace_with" value="<?php echo $config['convert_spaces']? $config['replace_with'] : "";?>" />

‎filemanager/execute.php‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,9 @@
99
exit;
1010
}
1111

12-
if (strpos($_POST['path'],'/')===0
13-
|| strpos($_POST['path'],'../')!==FALSE
14-
|| strpos($_POST['path'],'./')===0
15-
|| strpos($_POST['path'],'..\\')!==FALSE
16-
|| strpos($_POST['path'],'.\\')===0)
12+
if (!checkRelativePath($_POST['path']))
1713
{
18-
response(trans('wrong path'.AddErrorLocation()))->send();
14+
response(trans('wrong path'))->send();
1915
exit;
2016
}
2117

@@ -373,7 +369,7 @@ function returnPaths($_path,$_name,$config){
373369

374370
// something terribly gone wrong
375371
if ($action != 'copy' && $action != 'cut'){
376-
response(trans('wrong action').AddErrorLocation())->send();
372+
response(trans('wrong action'))->send();
377373
exit;
378374
}
379375
if($ftp){
@@ -514,7 +510,7 @@ function returnPaths($_path,$_name,$config){
514510

515511
break;
516512
default:
517-
response(trans('wrong action').AddErrorLocation())->send();
513+
response(trans('wrong action'))->send();
518514
exit;
519515
}
520516
}

‎filemanager/force_download.php‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,16 @@
1212
}
1313

1414

15-
if (
15+
if (!checkRelativePath($_POST['path']) ||
1616
strpos($_POST['path'], '/') === 0
17-
|| strpos($_POST['path'], '../') !== false
18-
|| strpos($_POST['path'], './') === 0
19-
|| strpos($_POST['path'], '..\\') !== false
20-
|| strpos($_POST['path'], '.\\') === 0
2117
) {
22-
response(trans('wrong path' . AddErrorLocation()), 400)->send();
18+
response(trans('wrong path'), 400)->send();
2319
exit;
2420
}
2521

2622

2723
if (strpos($_POST['name'], '/') !== false) {
28-
response(trans('wrong path' . AddErrorLocation()), 400)->send();
24+
response(trans('wrong path' ), 400)->send();
2925
exit;
3026
}
3127

‎filemanager/include/utils.php‎

Lines changed: 57 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,32 @@ function trans($var)
9494
}
9595
}
9696

97+
98+
99+
100+
/**
101+
* Check relative path
102+
*
103+
* @param string $path
104+
*
105+
* @return boolean is it correct?
106+
*/
107+
function checkRelativePath($path){
108+
$path_correct = true;
109+
$path_decoded = rawurldecode($path);
110+
if (strpos($path, '../') !== false
111+
|| strpos($path, './') !== false
112+
|| strpos($path, '..\\') !== false
113+
|| strpos($path, '.\\') !== false
114+
|| strpos($path_decoded, '../') !== false
115+
|| strpos($path_decoded, './') !== false
116+
|| strpos($path_decoded, '..\\') !== false
117+
|| strpos($path_decoded, '.\\') !== false) {
118+
$path_correct = false;
119+
}
120+
return $path_correct;
121+
}
122+
97123
/**
98124
* Delete file
99125
*
@@ -567,6 +593,34 @@ function check_files_extensions_on_path($path, $ext)
567593
}
568594
}
569595

596+
597+
/**
598+
* Check file extension
599+
*
600+
* @param string $extension
601+
* @param array $config
602+
*/
603+
604+
function check_file_extension($extension,$config){
605+
$check = false;
606+
if (!$config['ext_blacklist']) {
607+
if(in_array(mb_strtolower($extension), $conf['ext'])){
608+
$check = true;
609+
}
610+
} else {
611+
if(!in_array(mb_strtolower($extension), $conf['ext_blacklist'])){
612+
$check = true;
613+
}
614+
}
615+
616+
if($config['files_without_extension'] && $extension == ''){
617+
$check = true;
618+
}
619+
620+
return $check;
621+
}
622+
623+
570624
/**
571625
* Get file extension present in PHAR file
572626
*
@@ -575,13 +629,13 @@ function check_files_extensions_on_path($path, $ext)
575629
* @param string $basepath
576630
* @param string $ext
577631
*/
578-
function check_files_extensions_on_phar($phar, &$files, $basepath, $ext)
632+
function check_files_extensions_on_phar($phar, &$files, $basepath, $config)
579633
{
580634
foreach ($phar as $file)
581635
{
582636
if ($file->isFile())
583637
{
584-
if (in_array(mb_strtolower($file->getExtension()), $ext))
638+
if (check_file_extension($file->getExtension()))
585639
{
586640
$files[] = $basepath . $file->getFileName();
587641
}
@@ -591,7 +645,7 @@ function check_files_extensions_on_phar($phar, &$files, $basepath, $ext)
591645
if ($file->isDir())
592646
{
593647
$iterator = new DirectoryIterator($file);
594-
check_files_extensions_on_phar($iterator, $files, $basepath . $file->getFileName() . '/', $ext);
648+
check_files_extensions_on_phar($iterator, $files, $basepath . $file->getFileName() . '/', $config);
595649
}
596650
}
597651
}

‎filemanager/upload.php‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,8 @@
3434

3535
$fldr = rawurldecode(trim(strip_tags($_POST['fldr']), "/") . "/");
3636

37-
if (strpos($fldr, '../') !== false
38-
|| strpos($fldr, './') !== false
39-
|| strpos($fldr, '..\\') !== false
40-
|| strpos($fldr, '.\\') !== false) {
41-
response(trans('wrong path' . AddErrorLocation()))->send();
37+
if (!checkRelativePath($fldr)) {
38+
response(trans('wrong path'))->send();
4239
exit;
4340
}
4441

‎gulpfile.js‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,4 @@ elixir(function (mix) {
8888
['modernizr.custom.js'],
8989
'filemanager/js/modernizr.custom.js'
9090
);
91-
92-
mix.scripts(
93-
['load_more.js'],
94-
'filemanager/js/load_more.js'
95-
);
9691
});

0 commit comments

Comments
 (0)