maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

fix possible privilege escalation from customer to root when specifying custom error documents in directory-options

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2023-01-28 20:00:24 +01:00
parent bd5b99dc1c
commit 0034681412
5 changed files with 62 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
tests/Extras/DirOptionsTest.php
View File

@@ -191,4 +191,49 @@ class DirOptionsTest extends TestCase
$this->expectExceptionMessage("Directory option with id #1 could not be found");
DirOptions::getLocal($admin_userdata, $data)->get();
}
public function testCustomerDirOptionsAddMalformed()
{
global $admin_userdata;
// get customer
$json_result = Customers::getLocal($admin_userdata, array(
'loginname' => 'test1'
))->get();
$customer_userdata = json_decode($json_result, true)['data'];
$data = [
'path' => '/testmalformed',
'error404path' => '/"'.PHP_EOL.'something/../../../../weird 404.html'.PHP_EOL.'#'
];
$json_result = DirOptions::getLocal($customer_userdata, $data)->add();
$result = json_decode($json_result, true)['data'];
$expected = '/"something/././././weird\ 404.html#';
$this->assertEquals($expected, $result['error404path']);
}
public function testCustomerDirOptionsAddMalformedInvalid()
{
global $admin_userdata;
// get customer
$json_result = Customers::getLocal($admin_userdata, array(
'loginname' => 'test1'
))->get();
$customer_userdata = json_decode($json_result, true)['data'];
$data = [
'path' => '/testmalformed',
'error404path' => '"'.PHP_EOL.'IncludeOptional /something/else/'.PHP_EOL.'#'
];
$this->expectExceptionMessage("The value given as ErrorDocument does not seem to be a valid file, URL or string.");
DirOptions::getLocal($customer_userdata, $data)->add();
$data = [
'path' => '/testmalformed',
'error404path' => '"something"oh no a quote within the string"'
];
$this->expectExceptionMessage("The value given as ErrorDocument does not seem to be a valid file, URL or string.");
DirOptions::getLocal($customer_userdata, $data)->add();
}
}