blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-20 00:12:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

File Upload Security Fix bei HTML-Tags in Filenamen

Browse Source
This commit is contained in:
Andreas Österreicher
2010-09-22 15:26:14 +00:00
parent 06e585916c
commit 9a80d09cf2
2 changed files with 109 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cis/private/lehre/upload.php
+93 -86
View File
@@ -155,7 +155,7 @@
function checkvz(id)
{
vz = document.getElementById(id).value;
re = new RegExp(/^(\d|\w|\s|[-_])*$/);
re = new RegExp(/^(\d|\w|\s|[-_ÄÜÖäüö])*$/);
if (vz.match(re))
{
@@ -607,102 +607,52 @@ A:hover {
{
$file_name = $_FILES[$file]['name'];
if($file_name != "")
{
if(isset($subdir) && $subdir != "")
if(!check_filename($file_name))
{
echo "<center><b><font color='red'>Dateiname von Datei ".($i+1)." ist ung&uuml;ltig! Der Dateiname darf nur Buchstaben und Zahlen enthalten.</b></font></center>";
}
else
{
if($file_name != "")
{
$uploadfile = $upload_root.'/'.$uploaddir.'/'.$subdir.'/'.$file_name;
}
else
{
$uploadfile = $upload_root.'/'.$uploaddir.'/'.$file_name;
}
if(!file_exists($uploadfile))
{
if(isset($subdir) && $subdir != "")
{
if(!@is_dir($upload_root.'/'.$uploaddir.'/'.$subdir))
{
unset($subdir);
}
else
{
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
{
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
}
else
{
$unallowed_upload = true;
}
}
$uploadfile = $upload_root.'/'.$uploaddir.'/'.$subdir.'/'.$file_name;
}
else
{
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
{
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
}
else
{
$unallowed_upload = true;
}
$uploadfile = $upload_root.'/'.$uploaddir.'/'.$file_name;
}
}
else
{
if(isset($overwrite))
if(!file_exists($uploadfile))
{
if(isset($subdir) && $subdir != "")
{
if(!@is_dir($upload_root.'/'.$uploaddir.'/'.$subdir))
if(isset($subdir) && $subdir != "")
{
if(!@is_dir($upload_root.'/'.$uploaddir.'/'.$subdir))
{
unset($subdir);
unset($subdir);
}
else
{
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
{
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
}
else
{
$unallowed_upload = true;
$unallowed_upload = true;
}
}
}
@@ -725,15 +675,72 @@ A:hover {
}
else
{
$unallowed_upload = true;
$unallowed_upload = true;
}
}
$no_overwrite_error=false;
}
else
$no_overwrite_error=true;
{
if(isset($overwrite))
{
if(isset($subdir) && $subdir != "")
{
if(!@is_dir($upload_root.'/'.$uploaddir.'/'.$subdir))
{
unset($subdir);
}
else
{
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
{
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
}
else
{
$unallowed_upload = true;
}
}
}
else
{
if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl'))
{
if(copy($_FILES[$file]['tmp_name'], $uploadfile))
{
exec('chmod 664 "'.$uploadfile.'"');
if($islector)
{
exec('sudo chown :teacher "'.$uploadfile.'"');
}
else
{
exec('sudo chown :student "'.$uploadfile.'"');
}
}
}
else
{
$unallowed_upload = true;
}
}
$no_overwrite_error=false;
}
else
$no_overwrite_error=true;
}
}
}
}
}
}
}
@@ -820,7 +827,7 @@ A:hover {
{
if(isset($new_dir_name_text) && $new_dir_name_text != "")
{
if(!preg_match('/^(\d|\w|\s|[-_])*$/',$new_dir_name_text))
if(!check_filename($new_dir_name_text))
{
echo '<center><b>Verzeichnisname ist ungueltig!</b></center>';
}
include/functions.inc.php
+16
View File
@@ -761,4 +761,20 @@ function mb_str_replace( $needle, $replacement, $haystack )
}
return $haystack;
}
/**
*
* Prueft ob es sich um einen gueltigen Filenamen handelt
* Filenamen mit HTML-Tags oder sonstigem Schadcode sind nicht gueltig
*
* @param string $filename
* @return boolean true wenn gueltig, sonst false
*/
function check_filename($filename)
{
if(!preg_match('/^(\d|\w|\s|[-_.,ÄÜÖäüö!?])*$/',$filename))
return false;
else
return true;
}
?>