maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

add new directory-validator 'confdir' to check against disallowed paths (like /, /bin, /home, etc.)

Browse Source 
Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann (d00p)
2013-10-16 08:54:39 +02:00
parent 64e646b526
commit 6b93b973e2
5 changed files with 100 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/functions/formfields/string/function.validateFormFieldString.php
View File

@@ -68,6 +68,26 @@ function validateFormFieldString($fieldname, $fielddata, $newfieldvalue)
$returnvalue = ($newfieldvalue == makeCorrectDir($newfieldvalue));
}
}
elseif (isset($fielddata['string_type']) && $fielddata['string_type'] == 'confdir') {
// check for empty value (it might be allowed)
if (trim($newfieldvalue) == '') {
$newfieldvalue = '';
$returnvalue = 'stringmustntbeempty';
} else {
// add trailing slash to validate path if needed
// refs #331
if (substr($newfieldvalue, -1) != '/') {
$newfieldvalue.= '/';
}
// if this is a configuration directory, check for stupidity of admins :p
if (checkDisallowedPaths($newfieldvalue) !== true) {
$newfieldvalue = '';
$returnvalue = 'givendirnotallowed';
} else {
$returnvalue = ($newfieldvalue == makeCorrectDir($newfieldvalue));
}
}
}
elseif (isset($fielddata['string_type']) && $fielddata['string_type'] == 'file') {
// check for empty value (it might be allowed)
if (trim($newfieldvalue) == '') {