Changeset 2416

Timestamp:

09/14/06 00:53:46 (7 years ago)

Author:

qldrob

Message:

Merged revisions 2414 via svnmerge from
https://svn.sourceforge.net/svnroot/amportal/modules/branches/2.1

........

r2414 | qldrob | 2006-09-14 14:48:44 +1000 (Thu, 14 Sep 2006) | 2 lines

Remove remote command vulnerability in backup module - Thanks, Barrie!

........

Files:

• modules/branches/2.2 (modified) (1 prop)
• modules/branches/2.2/backup/page.backup.php (modified) (5 diffs)

modules/branches/2.2/backup/page.backup.php

@@ -20 +20 @@
-$type = 'tool';
-
+$dir=isset($_REQUEST['dir'])?$_REQUEST['dir']:'';
+$file=isset($_REQUEST['file'])?$_REQUEST['file']:'';
+$filetype=isset($_REQUEST['filetype'])?$_REQUEST['filetype']:'';
+$ID=isset($_REQUEST['backupid'])?$_REQUEST['backupid']:'';
+$name=((isset($_REQUEST['name'])&&empty($_REQUEST['name']))?'backup':$_REQUEST['name']);
+
+// Santity check passed params
+if (strpos($dir, '.') || strpos($dir, '\'') || strpos($dir, '"') || strpos($dir, '\'') || strpos($dir,'\`') ||
+    strpos($file, '.') || strpos($file, '\'') || strpos($file, '"') || strpos($file, '\'') || strpos($file,'\`') ||
+    strpos($ID, '.') || strpos($ID, '\'') || strpos($ID, '"') || strpos($ID, '\'') || strpos($ID,'\`') ||
+    strpos($filetype, '.') || strpos($filetype, '\'') || strpos($filetype, '"') || strpos($filetype, '\'') || strpos($filetype,'\`')) {
+  print "You're trying to use an invalid character. Please don't.\n";
+  exit;
+}
+
+
-switch ($action) {
-  case "addednew":
@@ -44 +60 @@
-  break;
-  case "edited":
-    $ID=$_REQUEST['backupid'];
-    Delete_Backup_set($ID);
-    $ALL_days=$_REQUEST['all_days'];
@@ -51 +66 @@
-
-    $backup_schedule=$_REQUEST['backup_schedule'];
-    $name=(empty($_REQUEST['name'])?'backup':$_REQUEST['name']);
-    $mins=$_REQUEST['mins'];
-    $hours=$_REQUEST['hours'];
@@ -68 +82 @@
-  break;
-  case "delete":
-    $ID=$_REQUEST['backupid'];
-    Delete_Backup_set($ID);
-  break;
-  case "deletedataset":
-    $dir=$_REQUEST['dir'];
-    exec("/bin/rm -rf '$dir'");
-  break;
-  case "deletefileset":
-    $dir=$_REQUEST['dir'];
-    exec("/bin/rm -rf '$dir'");
-  break;
-  case "restored":
-    $dir=$_REQUEST['dir'];
-    $file=$_REQUEST['file'];
-    $filetype=$_REQUEST['filetype'];
-    $Message=Restore_Tar_Files($dir, $file, $filetype, $display);
-    needreload();
@@ -164 +172 @@
-  <h2><?php echo _("System Restore")?></h2>
-<?php
-!isset($_REQUEST['dir']
+empty($dir
-    $dir = "/var/lib/asterisk/backups";
-    if(!is_dir($dir)) mkdir($dir);
-  } else {
-    $dir = "$_REQUEST[dir]";
-  }
-  $file = "$_REQUEST[file]";
-
-  Get_Tar_Files($dir, $display, $file);