composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-18 23:08:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°2538 check path validity little improvements

Browse Source 
* ajax-backup : change code to be more readable
* does a realpath() call on basepath to avoid troubles when havin '/' on Windows
This commit is contained in:
Pierre Goiffon
2019-10-16 11:32:31 +02:00
parent 607d355c61
commit f65f22f333
3 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
application/utils.inc.php
View File

@@ -2112,12 +2112,14 @@ class utils
*/
final public static function RealPath($sPath, $sBasePath)
{
$sRealBasePath = realpath($sBasePath); // avoid problems when having '/' on Windows for example
$sFileRealPath = realpath($sPath);
if ($sFileRealPath === false)
{
return false;
}
if (!self::StartsWith($sFileRealPath, $sBasePath))
if (!self::StartsWith($sFileRealPath, $sRealBasePath))
{
return false;
}

8
datamodels/2.x/itop-backup/ajax.backup.php
View File

@@ -179,14 +179,12 @@ EOF
$sFile = utils::ReadParam('file', '', false, 'raw_data');
$oBackup = new DBBackupScheduled();
$sBackupDir = APPROOT.'data/backups/';
if ($sBackupFilePath = utils::RealPath($sBackupDir.$sFile, $sBackupDir))
{
$oBackup->DownloadBackup($sBackupFilePath);
}
else
$sBackupFilePath = utils::RealPath($sBackupDir.$sFile, $sBackupDir);
if ($sBackupFilePath === false)
{
throw new CoreUnexpectedValue('Invalid file path');
}
$oBackup->DownloadBackup($sBackupFilePath);
break;
}
}

5
test/application/UtilsTest.php
View File

@@ -83,6 +83,11 @@ class UtilsTest extends \Combodo\iTop\Test\UnitTest\ItopTestCase
$sItopRootPath.'application',
$sItopRootPath.'application'.$sSep.'utils.inc.php',
],
'basepath containing / and \\' => [
$sItopRootPath.'sources/form/form.class.inc.php',
$sItopRootPath.'sources/form\\form.class.inc.php',
$sItopRootPath.'sources'.$sSep.'form'.$sSep.'form.class.inc.php',
],
];
}
}