admin/Studio-42-elFinder
1
0
Fork 0
mirror of https://github.com/Studio-42/elFinder synced 2026-06-08 12:37:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-wph3-44rj-92pr

Browse Source 
* [php] fix multiple vulnerabilities

* fix archiver args

* fix remote Code Execution of zip command

* re-fix remote Code Execution of zip command

* re-fix Improper hostname validation in upload and put

* re-fix Directory traversal in the actions mkfile and mkdir

* Add check targets in archive()
This commit is contained in:
Naoki Sawada
2021-06-13 23:38:02 +09:00
committed by GitHub
parent 60d1d76765
commit a106c350b7
4 changed files with 195 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/elFinderVolumeLocalFileSystem.class.php
+24 -5
View File
@@ -75,7 +75,6 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
$this->options['alias'] = ''; // alias to replace root dir name
$this->options['dirMode'] = 0755; // new dirs mode
$this->options['fileMode'] = 0644; // new files mode
$this->options['quarantine'] = '.quarantine'; // quarantine folder name - required to check archive (must be hidden)
$this->options['rootCssClass'] = 'elfinder-navbar-root-local';
$this->options['followSymLinks'] = true;
$this->options['detectDirIcon'] = ''; // file name that is detected as a folder icon e.g. '.diricon.png'
@@ -172,14 +171,20 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
}
}
// check quarantine path
$_quarantine = '';
if (!empty($this->options['quarantine'])) {
if (strpos($this->options['quarantine'], DIRECTORY_SEPARATOR) === false) {
$hiddens['quarantine'] = $this->options['quarantine'];
$this->options['quarantine'] = $this->_abspath($this->options['quarantine']);
//$hiddens['quarantine'] = $this->options['quarantine'];
//$this->options['quarantine'] = $this->_abspath($this->options['quarantine']);
$_quarantine = $this->_abspath($this->options['quarantine']);
$this->options['quarantine'] = '';
} else {
$this->options['quarantine'] = $this->_normpath($this->options['quarantine']);
}
} else {
$_quarantine = $this->_abspath('.quarantine');
}
is_dir($_quarantine) && self::localRmdirRecursive($_quarantine);
parent::configure();
@@ -223,6 +228,8 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
unset($hiddens['quarantine']);
}
}
} else if ($_path = elFinder::getCommonTempPath()) {
$this->quarantine = $_path;
}
if (!$this->quarantine) {
@@ -346,7 +353,20 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
**/
protected function _joinPath($dir, $name)
{
return rtrim($dir, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $name;
$dir = rtrim($dir, DIRECTORY_SEPARATOR);
$path = realpath($dir . DIRECTORY_SEPARATOR . $name);
// realpath() returns FALSE if the file does not exist
if ($path === false || strpos($path, $this->root) !== 0) {
if (DIRECTORY_SEPARATOR !== '/') {
$name = str_replace('/', DIRECTORY_SEPARATOR, $name);
}
// Directory traversal measures
if (strpos($name, '..' . DIRECTORY_SEPARATOR) !== false) {
$name = basename($name);
}
$path = $dir . DIRECTORY_SEPARATOR . $name;
}
return $path;
}
/**
@@ -1439,4 +1459,3 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
return $res;
}
} // END class