strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Checking includes for valid paths

Browse source
This commit is contained in:
Michael Vogel 2015-09-13 18:47:10 +02:00
commit 3ace2136f0
2 changed files with 40 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

28
boot.php
View file

@ -1893,3 +1893,31 @@ if(!function_exists('exif_imagetype')) {
return($size[2]);
}
}
function validate_include(&$file) {
$orig_file = $file;
$file = realpath($file);
if (strpos($file, getcwd()) !== 0)
return false;
$file = str_replace(getcwd()."/", "", $file, $count);
if ($count != 1)
return false;
if ($orig_file !== $file)
return false;
$valid = false;
if (strpos($file, "include/") === 0)
$valid = true;
if (strpos($file, "addon/") === 0)
$valid = true;
if (!$valid)
return false;
return true;
}