vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix refuse use of .. into PHP_SELF - reported by Wenhao Wu

Browse source
This commit is contained in:
Laurent Destailleur 2026-08-18 12:01:01 +02:00
parent 6acce68070
commit 5391c3e313
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
htdocs/dav/fileserver.php
View file

@ -47,14 +47,6 @@ if (!defined('NOCSRFCHECK')) {
}
require "../main.inc.php";
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php';
require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php';
/**
* @var Conf $conf
* @var DoliDB $db
@ -62,6 +54,13 @@ require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
* @var Translate $langs
* @var User $user
*/
require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.class.php';
require_once DOL_DOCUMENT_ROOT.'/dav/dav.lib.php';
require_once DOL_DOCUMENT_ROOT.'/includes/sabre/autoload.php';
//require_once DOL_DOCUMENT_ROOT.'/includes/autoload.php';
$user = new User($db);
if (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != '') {
@ -233,7 +232,7 @@ if (isset($baseUri)) {
// Add authentication function
if ((!getDolGlobalString('DAV_ALLOW_PUBLIC_DIR')
|| !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', $_SERVER["PHP_SELF"]))
|| !preg_match('/'.preg_quote(DOL_URL_ROOT.'/dav/fileserver.php/public', '/').'/', Sabre\Uri\normalize($_SERVER["PHP_SELF"])))
&& !preg_match('/^sabreAction=asset&assetName=[a-zA-Z0-9%\-\/]+\.(png|css|woff|ico|ttf)$/', $_SERVER["QUERY_STRING"]) // URL for Sabre browser resources
) {
//var_dump($_SERVER["QUERY_STRING"]);exit;

1
htdocs/waf.inc.php
View file

@ -239,6 +239,7 @@ function testSqlAndScriptInject($val, $type)
}
if ($type == 2) {
$inj += preg_match('/[:;"\'<>\?\(\){}\$%#]/', $val); // PHP_SELF is a file system (or url path without parameters). It can contains spaces.
$inj += preg_match('/\.\./', $val); // PHP_SELF is a file system (or url path without parameters). It must not contains '..'
}
return $inj;