composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-12 23:14:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

N°2154: Fix security breach (scratch install usecase)

Browse Source
This commit is contained in:
odain
2020-01-08 10:10:42 +01:00
parent 77fa02fcf9
commit 1fc290587c
3 changed files with 50 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/config.class.inc.php
View File

@@ -1894,6 +1894,8 @@ class Config
$sFileName = $this->m_sFile;
}
$oHandle = null;
$sConfig = null;
if (is_file($this->m_sFile))
{
$oHandle = fopen($this->m_sFile, 'r');
@@ -1907,8 +1909,9 @@ class Config
usleep(100000);
$index++;
}
$sConfig = file_get_contents($this->m_sFile);
}
$this->oItopConfigParser = new iTopConfigParser(file_get_contents($this->m_sFile));
$this->oItopConfigParser = new iTopConfigParser($sConfig);
if ($oHandle !==null)
{
flock($oHandle, LOCK_UN);

17
core/iTopConfigParser.php
View File

@@ -37,7 +37,16 @@ class iTopConfigParser
{
$oParser = (new ParserFactory())->create(ParserFactory::PREFER_PHP7);
$this->BrowseFile($oParser, $sConfig);
$this->aVarsMap = array(
'MySettings' => array(),
'MyModuleSettings' => array(),
'MyModules' => array(),
);
if ($sConfig !== null)
{
$this->BrowseFile($oParser, $sConfig);
}
}
/**
@@ -77,12 +86,6 @@ class iTopConfigParser
{
$prettyPrinter = new Standard();
$this->aVarsMap = array(
'MySettings' => array(),
'MyModuleSettings' => array(),
'MyModules' => array(),
);
try
{
$aNodes = $oParser->parse($sConfig);

37
test/core/iTopConfigParserTest.php
View File

@@ -132,7 +132,6 @@ class iTopConfigParserTest extends ItopTestCase
*/
public function testConfigWriteToFile()
{
exec("rm -f /tmp/config-itop*");
$tmpConfigFileBeforePath = tempnam( '/tmp/', 'config-itop');
$tmpConfigFileAfterPath = tempnam( '/tmp/', 'config-itop');
@@ -176,4 +175,40 @@ CONF;
unlink($tmpConfigFileBeforePath);
$this->assertEquals($tmpConfigContentBefore, $tmpConfigContentAfter);
}
/**
* @doesNotPerformAssertions
*
* @throws \ConfigException
* @throws \CoreException
*/
public function testConfigWriteToFile_FromScratchInstallation()
{
$sConfigPath = utils::GetConfigFilePath();
$tmpSavePath = tempnam( '/tmp/', 'config-itop');
$conf_exists = is_file($sConfigPath);
if ($conf_exists)
{
rename($sConfigPath, $tmpSavePath);
}
$oConfig = new Config($sConfigPath, false);
try{
$oConfig->WriteToFile();
if ($conf_exists)
{
rename($tmpSavePath, $sConfigPath);
}
}catch(\Exception $e)
{
if ($conf_exists)
{
rename($tmpSavePath, $sConfigPath);
}
$this->assertTrue(false, "failed writetofile with no initial file");
}
}
}