diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php index 322e68e38f..32c4b8dde1 100644 --- a/application/dashboard.class.inc.php +++ b/application/dashboard.class.inc.php @@ -852,28 +852,29 @@ class RuntimeDashboard extends Dashboard { $bCustomized = false; - if (!appUserPreferences::GetPref('display_original_dashboard_'.$sDashBoardId, false)) - { + $sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT); + if (false === $sDashboardFileSanitized) { + throw new SecurityException('Invalid dashboard file !'); + } + + if (!appUserPreferences::GetPref('display_original_dashboard_'.$sDashBoardId, false)) { // Search for an eventual user defined dashboard $oUDSearch = new DBObjectSearch('UserDashboard'); $oUDSearch->AddCondition('user_id', UserRights::GetUserId(), '='); $oUDSearch->AddCondition('menu_code', $sDashBoardId, '='); $oUDSet = new DBObjectSet($oUDSearch); - if ($oUDSet->Count() > 0) - { + if ($oUDSet->Count() > 0) { // Assuming there is at most one couple {user, menu}! $oUserDashboard = $oUDSet->Fetch(); $sDashboardDefinition = $oUserDashboard->Get('contents'); $bCustomized = true; - } - else - { - $sDashboardDefinition = @file_get_contents($sDashboardFile); + } else { + $sDashboardDefinition = @file_get_contents($sDashboardFileSanitized); } } else { - $sDashboardDefinition = @file_get_contents($sDashboardFile); + $sDashboardDefinition = @file_get_contents($sDashboardFileSanitized); } if ($sDashboardDefinition !== false) @@ -881,7 +882,7 @@ class RuntimeDashboard extends Dashboard $oDashboard = new RuntimeDashboard($sDashBoardId); $oDashboard->FromXml($sDashboardDefinition); $oDashboard->SetCustomFlag($bCustomized); - $oDashboard->SetDefinitionFile($sDashboardFile); + $oDashboard->SetDefinitionFile($sDashboardFileSanitized); } else { diff --git a/core/action.class.inc.php b/core/action.class.inc.php index d7ff9d367a..5bb64979bd 100644 --- a/core/action.class.inc.php +++ b/core/action.class.inc.php @@ -314,42 +314,54 @@ class ActionEmail extends ActionNotification { $this->m_iRecipients = 0; $this->m_aMailErrors = array(); - $bRes = false; // until we do succeed in sending the email - + // Determine recicipients // $sTo = $this->FindRecipients('to', $aContextArgs); $sCC = $this->FindRecipients('cc', $aContextArgs); $sBCC = $this->FindRecipients('bcc', $aContextArgs); - + $sFrom = MetaModel::ApplyParams($this->Get('from'), $aContextArgs); $sReplyTo = MetaModel::ApplyParams($this->Get('reply_to'), $aContextArgs); - + $sSubject = MetaModel::ApplyParams($this->Get('subject'), $aContextArgs); $sBody = MetaModel::ApplyParams($this->Get('body'), $aContextArgs); - + $oObj = $aContextArgs['this->object()']; - $sMessageId = sprintf('iTop_%s_%d_%f@%s.openitop.org', get_class($oObj), $oObj->GetKey(), microtime(true /* get as float*/), MetaModel::GetEnvironmentId()); + $sMessageId = sprintf('iTop_%s_%d_%f@%s.openitop.org', get_class($oObj), $oObj->GetKey(), microtime(true /* get as float*/), + MetaModel::GetEnvironmentId()); $sReference = '<'.$sMessageId.'>'; } - catch(Exception $e) - { - ApplicationContext::SetUrlMakerClass($sPreviousUrlMaker); - throw $e; - } - ApplicationContext::SetUrlMakerClass($sPreviousUrlMaker); - - if (!is_null($oLog)) - { + catch (Exception $e) { + /** @noinspection PhpUnhandledExceptionInspection */ + throw $e; + } + finally { + ApplicationContext::SetUrlMakerClass($sPreviousUrlMaker); + } + + if (!is_null($oLog)) { // Note: we have to secure this because those values are calculated // inside the try statement, and we would like to keep track of as // many data as we could while some variables may still be undefined - if (isset($sTo)) $oLog->Set('to', $sTo); - if (isset($sCC)) $oLog->Set('cc', $sCC); - if (isset($sBCC)) $oLog->Set('bcc', $sBCC); - if (isset($sFrom)) $oLog->Set('from', $sFrom); - if (isset($sSubject)) $oLog->Set('subject', $sSubject); - if (isset($sBody)) $oLog->Set('body', $sBody); + if (isset($sTo)) { + $oLog->Set('to', $sTo); + } + if (isset($sCC)) { + $oLog->Set('cc', $sCC); + } + if (isset($sBCC)) { + $oLog->Set('bcc', $sBCC); + } + if (isset($sFrom)) { + $oLog->Set('from', $sFrom); + } + if (isset($sSubject)) { + $oLog->Set('subject', $sSubject); + } + if (isset($sBody)) { + $oLog->Set('body', $sBody); + } } $sStyles = file_get_contents(APPROOT.'css/email.css'); $sStyles .= MetaModel::GetConfig()->Get('email_css'); @@ -439,4 +451,3 @@ class ActionEmail extends ActionNotification } } } -?> diff --git a/core/metamodel.class.php b/core/metamodel.class.php index 1e93c71511..6ae3007489 100644 --- a/core/metamodel.class.php +++ b/core/metamodel.class.php @@ -7330,9 +7330,11 @@ abstract class MetaModel * @param string $sInput * @param array $aParams * - * @return mixed + * @return string + * + * @throws \Exception */ - static public function ApplyParams($sInput, $aParams) + public static function ApplyParams($sInput, $aParams) { $aParams = static::AddMagicPlaceholders($aParams); @@ -7342,7 +7344,7 @@ abstract class MetaModel $aSearches = array(); $aReplacements = array(); - foreach($aParams as $sSearch => $replace) + foreach ($aParams as $sSearch => $replace) { // Some environment parameters are objects, we just need scalars if (is_object($replace)) diff --git a/pages/ajax.render.php b/pages/ajax.render.php index 4abb98bbc7..ac60b0463d 100644 --- a/pages/ajax.render.php +++ b/pages/ajax.render.php @@ -1217,7 +1217,7 @@ try break; case 'save_dashboard': - $sDashboardId = utils::ReadParam('dashboard_id', '', false, 'raw_data'); + $sDashboardId = utils::ReadParam('dashboard_id', '', false, 'element_identifier'); $aExtraParams = utils::ReadParam('extra_params', array(), false, 'raw_data'); $sReloadURL = utils::ReadParam('reload_url', '', false, 'raw_data'); $sJSExtraParams = json_encode($aExtraParams); @@ -1230,17 +1230,16 @@ try $oDashboard = new RuntimeDashboard($sDashboardId); $oDashboard->FromParams($aParams); $oDashboard->Save(); - $sDashboardFile = addslashes(utils::ReadParam('file', '', false, 'raw_data')); - $sDivId = utils::Sanitize($sDashboardId, '', 'element_identifier'); + $sDashboardFile = addslashes(utils::ReadParam('file', '', false, 'string')); // trigger a reload of the current page since the dashboard just changed $oPage->add_script( -<<ok("The installation completed successfully."); } + $bHasBackup = false; if (($this->oWizard->GetParameter('mode', '') == 'upgrade') && $this->oWizard->GetParameter('db_backup', false) && $this->oWizard->GetParameter('authent', false)) { $sBackupDestination = $this->oWizard->GetParameter('db_backup_path', ''); if (file_exists($sBackupDestination.'.tar.gz')) { + $bHasBackup = true; // To mitigate security risks: pass only the filename without the extension, the download will add the extension itself $oPage->p('Your backup is ready'); $oPage->p(' Download '.basename($sBackupDestination).''); @@ -2665,10 +2667,14 @@ class WizStepDone extends WizardStep $oPage->add(''); $sForm = addslashes($sForm); $oPage->add_ready_script("$('#wiz_form').after('$sForm');"); + // avoid leaving in a dirty state SetupUtils::ExitMaintenanceMode(false); SetupUtils::ExitReadOnlyMode(false); - SetupUtils::EraseSetupToken(); + + if (false === $bHasBackup) { + SetupUtils::EraseSetupToken(); + } } public function CanMoveForward()