Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

FIX vulenrability in uploading file found by 美创科技安全实验室

Browse Source
This commit is contained in:
Laurent Destailleur
2019-08-16 21:45:13 +02:00
parent d51a651ab4
commit 898996da4a
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/core/lib/files.lib.php
View File

@@ -985,6 +985,7 @@ function dolCheckVirus($src_file)
* - This function can be used only into a HTML page context. Use dol_move if you are outside. * - This function can be used only into a HTML page context. Use dol_move if you are outside.
* - Test on antivirus is always done (if antivirus set). * - Test on antivirus is always done (if antivirus set).
* - Database of files is NOT updated (this is done by dol_add_file_process() that calls this function). * - Database of files is NOT updated (this is done by dol_add_file_process() that calls this function).
* - Extension .noexe may be added if file is executable and MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED is not set.
* *
* @param string $src_file Source full path filename ($_FILES['field']['tmp_name']) * @param string $src_file Source full path filename ($_FILES['field']['tmp_name'])
* @param string $dest_file Target full path filename ($_FILES['field']['name']) * @param string $dest_file Target full path filename ($_FILES['field']['name'])
@@ -1063,15 +1064,15 @@ function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite, $disable
// Security: // Security:
// We refuse cache files/dirs, upload using .. and pipes into filenames. // We refuse cache files/dirs, upload using .. and pipes into filenames.
if (preg_match('/^\./', $src_file) || preg_match('/\.\./', $src_file) || preg_match('/[<>|]/', $src_file)) if (preg_match('/^\./', basename($src_file)) || preg_match('/\.\./', $src_file) || preg_match('/[<>|]/', $src_file))
{ {
dol_syslog("Refused to deliver file ".$src_file, LOG_WARNING); dol_syslog("Refused to deliver file ".$src_file, LOG_WARNING);
return -1; return -1;
} }
// Security: // Security:
// On interdit fichiers caches, remontees de repertoire ainsi que les pipe dans les noms de fichiers. // We refuse cache files/dirs, upload using .. and pipes into filenames.
if (preg_match('/^\./', $dest_file) || preg_match('/\.\./', $dest_file) || preg_match('/[<>|]/', $dest_file)) if (preg_match('/^\./', basename($dest_file)) || preg_match('/\.\./', $dest_file) || preg_match('/[<>|]/', $dest_file))
{ {
dol_syslog("Refused to deliver file ".$dest_file, LOG_WARNING); dol_syslog("Refused to deliver file ".$dest_file, LOG_WARNING);
return -2; return -2;

3
htdocs/core/lib/functions.lib.php
View File

@@ -796,7 +796,8 @@ function dol_size($size, $type = '')
*/ */
function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1) function dol_sanitizeFileName($str, $newstr = '_', $unaccent = 1)
{ {
$filesystem_forbidden_chars = array('<','>','/','\\','?','*','|','"','°'); // List of special chars for filenames are defined on page https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file
$filesystem_forbidden_chars = array('<', '>', '/', '\\', '?', '*', '|', '"', ':', '°');
return dol_string_nospecial($unaccent?dol_string_unaccent($str):$str, $newstr, $filesystem_forbidden_chars); return dol_string_nospecial($unaccent?dol_string_unaccent($str):$str, $newstr, $filesystem_forbidden_chars);
} }