composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-13 07:24:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

N°3248 - code hardening

Browse Source
This commit is contained in:
Eric
2020-08-18 17:02:46 +02:00
parent 6176af089c
commit f74c78d61c
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
application/transaction.class.inc.php
View File

@@ -234,7 +234,14 @@ class privUITransactionFile
*/ */
public static function IsTransactionValid($id, $bRemoveTransaction = true) public static function IsTransactionValid($id, $bRemoveTransaction = true)
{ {
$sFilepath = APPROOT.'data/transactions/'.$id; // Constraint the transaction file within APPROOT.'data/transactions'
$sTransactionDir = realpath(APPROOT.'data/transactions');
$sFilepath = utils::RealPath($sTransactionDir.'/'.$id, $sTransactionDir);
if (($sFilepath === false) || (strlen($sTransactionDir) == strlen($sFilepath)))
{
return false;
}
clearstatcache(true, $sFilepath); clearstatcache(true, $sFilepath);
$bResult = file_exists($sFilepath); $bResult = file_exists($sFilepath);
if ($bResult) if ($bResult)
@@ -245,6 +252,7 @@ class privUITransactionFile
if (!$bResult) if (!$bResult)
{ {
self::Error('IsTransactionValid: FAILED to remove transaction '.$id); self::Error('IsTransactionValid: FAILED to remove transaction '.$id);
return false;
} }
else else
{ {

3
application/utils.inc.php
View File

@@ -307,6 +307,7 @@ class utils
case 'context_param': case 'context_param':
case 'parameter': case 'parameter':
case 'field_name': case 'field_name':
case 'transaction_id':
if (is_array($value)) if (is_array($value))
{ {
$retValue = array(); $retValue = array();
@@ -2223,7 +2224,7 @@ class utils
* @param string $sPath for example '/var/www/html/itop/data/backups/manual/itop_27-2019-10-03_15_35.tar.gz' * @param string $sPath for example '/var/www/html/itop/data/backups/manual/itop_27-2019-10-03_15_35.tar.gz'
* @param string $sBasePath for example '/var/www/html/itop/data/' * @param string $sBasePath for example '/var/www/html/itop/data/'
* *
* @return bool false if path : * @return bool|string false if path :
* * invalid * * invalid
* * not allowed * * not allowed
* * not contained in base path * * not contained in base path