composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-09-29 21:09:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°9654 - Reduce surface attack on config file rights during setup (#932)

Browse Source
This commit is contained in:
Lenaick
2026-06-09 16:56:58 +02:00
committed by GitHub
parent f48efbbd03
commit 733eea8a78
15 changed files with 46 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
setup/ajax.dataloader.php
View File

@@ -35,6 +35,7 @@
* 'percent': integer 0..100 the percentage of completion once the file has been loaded
*/
use Combodo\iTop\Application\Helper\Session;
use Combodo\iTop\Application\WebPage\AjaxPage;
$bBypassMaintenance = true; // Reset maintenance mode in case of problem
@@ -129,7 +130,10 @@ header("Expires: Fri, 17 Jul 1970 05:00:00 GMT"); // Date in the past
*/
$sOperation = utils::ReadParam('operation', '');
try {
SetupUtils::CheckSetupToken();
Session::Start();
if (!SetupUtils::IsSessionSetupTokenValid()) {
throw new SecurityException("Invalid session token");
}
switch ($sOperation) {
case 'async_action':
@@ -150,14 +154,7 @@ try {
/** @var WizardStep $oStep */
$oStep = new $sClass($oDummyController, $sState);
$sConfigFile = utils::GetConfigFilePath(ITOP_DEFAULT_ENV);
if (file_exists($sConfigFile) && !is_writable($sConfigFile) && $oStep->RequiresWritableConfig()) {
$sRelativePath = utils::GetConfigFilePathRelative(ITOP_DEFAULT_ENV);
$sErrorMsg = "<b>Error:</b> the configuration file '".$sRelativePath."' already exists and cannot be overwritten.";
$sErrorMsg .= "The wizard cannot modify the configuration file for you. If you want to upgrade ".ITOP_APPLICATION.", make sure that the file '<b>".$sRelativePath."</b>' can be modified by the web server.";
throw new Exception($sErrorMsg);
} else {
$oStep->AsyncAction($oPage, $sActionCode, $aParams);
}
$oStep->AsyncAction($oPage, $sActionCode, $aParams);
}
$oPage->output();
break;