fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Using just pathinfo to validate that a file name and not a relative path \was sent

Browse Source
This commit is contained in:
dante
2017-08-08 08:35:40 -04:00
parent 8538fffd66
commit e41d6d460f
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
workflow/engine/controllers/pmTables.php
View File

@@ -153,7 +153,7 @@ class pmTables extends Controller
$realPath = $PUBLIC_ROOT_PATH . $sFileName;
if ($this->isValidFileToBeStreamed($realPath, $PUBLIC_ROOT_PATH) === false) {
if ($this->isValidFileToBeStreamed($sFileName) === false) {
throw new Exception("You are trying to access an unauthorized resource.");
}
@@ -213,25 +213,22 @@ class pmTables extends Controller
}
/**
* Validates if the file with the path $filePath is a valid one,
* that is, it must be a file within the temporal directory where the
* exported pmt files are created and must have one of the valid file
* extensions.
* Validates if the file with the $fileName is a valid one,
* that is, it must be a file without relative references that
* can open a door to get some unauthorized system file and
* must have one of the valid file extensions.
*
* @param $filePath, full path to the temporal file that will be streamed
* @param $tempDir, directory's path where the temporal files are created.
* @param $fileName, emporal file name that will be streamed
* @return bool
*/
private function isValidFileToBeStreamed($filePath, $tempDir)
private function isValidFileToBeStreamed($fileName)
{
$result = true;
$validExtensionsForExporting = ['csv', 'pmt'];
$fileRealPath = realpath($filePath);
$tempDirRealPath = realpath($tempDir);
$pathInfo = pathinfo($fileRealPath);
$pathInfo = pathinfo($fileName);
if ($pathInfo ['dirname'] !== $tempDirRealPath) {
if ($pathInfo ['dirname'] !== '.') {
$result = false;
}