Changeset 4412

Timestamp:

07/17/07 02:52:17 (6 years ago)

Author:

gregmac

Message:

Add "file" handler for secure file pass-through,
Update "freepbx" view to use file handler for auto-inclusion of module CSS and JS files

Files:

• freepbx/branches/2.3/amp_conf/htdocs/admin/config.php (modified) (1 diff)
• freepbx/branches/2.3/amp_conf/htdocs/admin/views/freepbx.php (modified) (1 diff)

freepbx/branches/2.3/amp_conf/htdocs/admin/config.php

@@ -32 +32 @@
-  switch ($_REQUEST['handler']) {
-    case 'reload':
+      /** AJAX handler for reload event
+       */
-      include_once('common/json.inc.php');
-      $response = do_reload();
-      $json = new Services_JSON();
-      echo $json->encode($response);
+    break;
+    case 'file':
+      /** Handler to pass-through file requests 
+       * Looks for "module" and "file" variables, strips .. and only allows normal filename characters.
+       * Accepts only files of the type listed in $allowed_exts below, and sends the corresponding mime-type, 
+       * and always interprets files through the PHP interpreter. (Most of?) the freepbx environment is available,
+       * including $db and $astman, and the user is authenticated.
+       */
+      if (!isset($_REQUEST['module']) || !isset($_REQUEST['file'])) {
+        die("unknown");
+      }
+      //TODO: this could probably be more efficient
+      $module = str_replace('..','.', preg_replace('/[^a-zA-Z0-9-\_\.]/','',$_REQUEST['module']));
+      $file = str_replace('..','.', preg_replace('/[^a-zA-Z0-9-\_\.]/','',$_REQUEST['file']));
+      
+      $allowed_exts = array(
+        '.js' => 'text/javascript',
+        '.js.php' => 'text/javascript',
+        '.css' => 'text/css',
+        '.css.php' => 'text/css',
+        '.html.php' => 'text/html',
+        '.jpg.php' => 'image/jpeg',
+        '.jpeg.php' => 'image/jpeg',
+        '.png.php' => 'image/png',
+        '.gif.php' => 'image/gif',
+      );
+      foreach ($allowed_exts as $ext=>$mimetype) {
+        if (substr($file, -1*strlen($ext)) == $ext) {
+          $fullpath = 'modules/'.$module.'/'.$file;
+          if (file_exists($fullpath)) {
+            // file exists, and is allowed extension
+            header("Content-type: ".$mimetype);
+            include($fullpath);
+            exit();
+          }
+          break;
+        }
+      }
+      die("not allowed");
-    break;
-  }

freepbx/branches/2.3/amp_conf/htdocs/admin/views/freepbx.php

@@ -58 +58 @@
-  if (isset($module_name)) {
-    if (is_file('modules/'.$module_name.'/'.$module_name.'.css')) {
-modules/'.$module_name.'/
+'.$_SERVER['PHP_SELF'].'?handler=file&module='.$module_name.'&file=
-    }
-    if (isset($module_page) && is_file('modules/'.$module_name.'/'.$module_page.'.css')) {
-modules/'.$module_name.'/
+'.$_SERVER['PHP_SELF'].'?handler=file&module='.$module_name.'&file=
-    }
-    if (is_file('modules/'.$module_name.'/'.$module_name.'.js')) {
-modules/'.$module_name.'/
+'.$_SERVER['PHP_SELF'].'?handler=file&module='.$module_name.'&file=
-    }
-    if (isset($module_page) && is_file('modules/'.$module_name.'/'.$module_page.'.js')) {
-modules/'.$module_name.'/
+'.$_SERVER['PHP_SELF'].'?handler=file&module='.$module_name.'&file=
-    }
-  }