FbIN/htmly
1
0
Fork 0
mirror of https://github.com/danpros/htmly.git synced 2026-04-23 05:56:22 +05:30
Code Issues Projects Releases Packages Wiki Activity

addressed path traversal vulnerability

Browse source
This commit is contained in:
kali 2024-04-27 10:43:40 -04:00
commit 0f0c1bbd45
1 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

38
system/admin/admin.php
View file

@ -903,8 +903,25 @@ function delete_post($file, $destination)
$role = user('role', $user); $role = user('role', $user);
$arr = explode('/', $file); $arr = explode('/', $file);
if ($arr[0] !== 'content') // realpath resolves all traversal operations like ../
$realFilePath = realpath($file);
// realpath returns an empty string if the file does not exist
if ($realFilePath == '') {
return; return;
}
// get the current project working directory
$cwd = getcwd();
// content directory relative to the current project working directory
$contentDir = $cwd . '\content';
// if the file path does not start with $contentDir, it means its accessing
// files in folders other than content
if (strpos($realFilePath, $contentDir) !== 0) {
return;
}
// Get cache file // Get cache file
$info = pathinfo($file); $info = pathinfo($file);
@ -937,8 +954,25 @@ function delete_page($file, $destination)
$role = user('role', $user); $role = user('role', $user);
$arr = explode('/', $file); $arr = explode('/', $file);
if ($arr[0] !== 'content') // realpath resolves all traversal operations like ../
$realFilePath = realpath($file);
// realpath returns an empty string if the file does not exist
if ($realFilePath == '') {
return; return;
}
// get the current project working directory
$cwd = getcwd();
// content directory relative to the current project working directory
$contentDir = $cwd . '\content';
// if the file path does not start with $contentDir, it means its accessing
// files in folders other than content
if (strpos($realFilePath, $contentDir) !== 0) {
return;
}
if (!empty($menu)) { if (!empty($menu)) {
foreach (glob('cache/page/*.cache', GLOB_NOSORT) as $file) { foreach (glob('cache/page/*.cache', GLOB_NOSORT) as $file) {