From 5391c3e3136604dc525a2ba1611484ad2b406f41 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 18 Aug 2026 12:01:01 +0200 Subject: [PATCH] Fix refuse use of .. into PHP_SELF - reported by Wenhao Wu --- htdocs/dav/fileserver.php | 17 ++++++++--------- htdocs/waf.inc.php | 1 + 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/htdocs/dav/fileserver.php b/htdocs/dav/fileserver.php index 99a15d6435f..f31eb26605c 100644 --- a/htdocs/dav/fileserver.php +++ b/htdocs/dav/fileserver.php @@ -47,14 +47,6 @@ if (!defined('NOCSRFCHECK')) { } require "../main.inc.php"; -require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; -require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; -require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php'; -require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php'; - -require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php'; -//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php'; - /** * @var Conf $conf * @var DoliDB $db @@ -62,6 +54,13 @@ require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php'; * @var Translate $langs * @var User $user */ +require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; +require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php'; +require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php'; + +require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php'; +//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php'; $user = new User($db); if (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != '') { @@ -233,7 +232,7 @@ if (isset($baseUri)) { // Add authentication function if ((!getDolGlobalString('DAV_ALLOW_PUBLIC_DIR') - || !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', $_SERVER["PHP_SELF"])) + || !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', Sabre\Uri\normalize($_SERVER["PHP_SELF"]))) && !preg_match('/^sabreAction=asset&assetName=[a-zA-Z0-9%\-\/]+\.(png|css|woff|ico|ttf)$/', $_SERVER["QUERY_STRING"]) // URL for Sabre browser resources ) { //var_dump($_SERVER["QUERY_STRING"]);exit; diff --git a/htdocs/waf.inc.php b/htdocs/waf.inc.php index 944ecb1e473..e001cc9cdde 100644 --- a/htdocs/waf.inc.php +++ b/htdocs/waf.inc.php @@ -239,6 +239,7 @@ function testSqlAndScriptInject($val, $type) } if ($type == 2) { $inj += preg_match('/[:;"\'<>\?\(\){}\$%#]/', $val); // PHP_SELF is a file system (or url path without parameters). It can contains spaces. + $inj += preg_match('/\.\./', $val); // PHP_SELF is a file system (or url path without parameters). It must not contains '..' } return $inj;