Changeset 20706

Timestamp:

Feb 11, 2013, 10:49:28 PM (11 years ago)

Author:

plg

Message:

filter $_GETdl, it must be a md5sum-like string and nothing else

File:

• branches/2.4/install.php (modified) (3 diffs)

branches/2.4/install.php

@@ -110 +110 @@
 defined('PWG_LOCAL_DIR') or define('PWG_LOCAL_DIR', 'local/');
 
+include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
+
 // download database config file if exists
+check_input_parameter('dl', $_GET, false, '/^[a-f0-9]{32}$/');
+
 if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
 {
@@ -157 +161 @@
 
 include(PHPWG_ROOT_PATH . 'include/constants.php');
-include(PHPWG_ROOT_PATH . 'include/functions.inc.php');
 include(PHPWG_ROOT_PATH . 'admin/include/functions.php');
 
@@ -285 +288 @@
     if ( !($fp = @fopen( $config_file, 'w' )))
     {
+      // make sure nobody can list files of _data directory
+      secure_directory(PHPWG_ROOT_PATH.$conf['data_location']);
+      
       $tmp_filename = md5(uniqid(time()));
       $fh = @fopen( PHPWG_ROOT_PATH.$conf['data_location'] . 'pwg_' . $tmp_filename, 'w' );