Peter M. Groen / knowledgetree

Commit 7d8daad4271eae637322a789a5733d602ee5f8ae

Authored by Megan Watson
1 parent d4782b2f

Security fix for webservice uploads using a relative path. 

Committed by: Megan Watson
Inline Side-by-side
Showing 1 changed file with 12 additions and 6 deletions
ktwebservice/KTUploadManager.inc.php
  View file @7d8daad
... ... @@ -105,15 +105,27 @@ class KTUploadManager
105 105  
106 106 $check = ($tempdir == $main_temp_dir);
107 107  
  108 + /*
  109 + Removing the return, if the file is not directly in the temp directory then it may be a security risk, for instance a file can be uploaded using the following tempfilename: /var/www/var/uploads/../../../../etc/passwd
  110 + Checking the basename of the file should negate this risk.
108 111 if($check){
109 112 return $check;
110 113 }
  114 + */
111 115  
112 116 // in case of a symlinked directory, check if the file exists and is in the uploads directory
113 117 $file = basename($tempfilename);
114 118 $path = $this->temp_dir . DIRECTORY_SEPARATOR . $file;
115 119  
116 120 if(file_exists($path)){
  121 +
  122 + // Added check - if file name contains ../ to get down a few levels into the root filesystem
  123 + if(strpos($tempfilename, '../') !== false){
  124 + global $default;
  125 + $default->log->error('Upload Manager: temporary filename contains relative path: '.$tempfilename .' could be attempting to access root level files');
  126 + return false;
  127 + }
  128 +
117 129 return true;
118 130 }
119 131  
... ... @@ -122,12 +134,6 @@ class KTUploadManager
122 134 $default->log->error('Upload Manager: can\'t resolve temporary filename: '.$tempfilename .' in uploads directory: '.$this->temp_dir);
123 135  
124 136 return false;
125   -
126   - /*
127   - $tempdir = substr($tempfilename,0,strlen($this->temp_dir));
128   - $tempdir = str_replace('\\','/', $tempdir);
129   - return ($tempdir == $this->temp_dir);
130   - */
131 137 }
132 138  
133 139 function store_base64_file($base64, $prefix= 'sa_')
... ...