fernando/luos
1
0
Fork 0
Code Releases Activity

veracode medium issues

Browse Source 
Directory Transversal, OS Command Injection
This commit is contained in:
marcelo.cuiza
2015-04-06 17:43:51 -04:00
parent 4824edcf80
commit cac0c4e96e
10 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
workflow/engine/classes/class.case.php
View File

@@ -3797,6 +3797,10 @@ class Cases
if (!is_dir($strPathName)) {
G::verifyPath($strPathName, true);
}
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$file = $filter->xssFilterHard($file, 'path');
copy($file, $strPathName . $strFileName);
chmod($strPathName . $strFileName, 0666);

4
workflow/engine/classes/class.pmLicenseManager.php
View File

@@ -442,6 +442,10 @@ class pmLicenseManager
$LicenseStatus = $this->lookForStatusLicense(); //we're looking for a status ACTIVE
//getting the content from file
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$path = $filter->xssFilterHard($path, 'path');
$handle = fopen ( $path, "r" );
$contents = fread ( $handle, filesize ( $path ) );
fclose ( $handle );

1
workflow/engine/classes/class.system.php
View File

@@ -287,6 +287,7 @@ class System
$tempFilename = isset( $_FILES['form']['tmp_name']['UPGRADE_FILENAME'] ) ? $_FILES['form']['tmp_name']['UPGRADE_FILENAME'] : '';
$this->sRevision = str_replace( '.tar.gz', '', str_replace( 'pmos-patch-', '', $upgradeFilename ) );
$sTemFilename = $tempFilename;
$sTemFilename = $filter->xssFilterHard($sTemFilename, 'path');
$pathFile = $filter->xssFilterHard(PATH_DATA . 'upgrade' . PATH_SEP . $upgradeFilename, 'path');
$this->sFilename = $pathFile;
$this->sPath = dirname( $this->sFilename ) . PATH_SEP;