Mercurial > hg > mlmmj
annotate contrib/web/php-admin/htdocs/save.php @ 783:a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
(Florian Streibelt, Morten Shearman Kirkegaard)
| author | Ben Schmidt |
|---|---|
| date | Sun, 21 Nov 2010 00:25:20 +1100 |
| parents | 6d354f3a8d90 |
| children | d92234debf5c |
| rev | line source |
|---|---|
| 309 | 1 <?php |
| 2 | |
| 3 /* mlmmj/php-admin: | |
| 4 * Copyright (C) 2004 Christoph Thiel <ct at kki dot org> | |
| 5 * | |
| 6 * mlmmj/php-perl: | |
| 7 * Copyright (C) 2004 Morten K. Poulsen <morten at afdelingp.dk> | |
| 8 * Copyright (C) 2004 Christian Laursen <christian@pil.dk> | |
| 9 * | |
| 10 * Permission is hereby granted, free of charge, to any person obtaining a copy | |
| 11 * of this software and associated documentation files (the "Software"), to | |
| 12 * deal in the Software without restriction, including without limitation the | |
| 13 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or | |
| 14 * sell copies of the Software, and to permit persons to whom the Software is | |
| 15 * furnished to do so, subject to the following conditions: | |
| 16 * | |
| 17 * The above copyright notice and this permission notice shall be included in | |
| 18 * all copies or substantial portions of the Software. | |
| 19 * | |
| 20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
| 21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
| 22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
| 23 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
| 24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | |
| 25 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS | |
| 26 * IN THE SOFTWARE. | |
| 27 */ | |
| 28 | |
| 29 require("../conf/config.php"); | |
|
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
30 require("class.rFastTemplate.php"); |
| 309 | 31 |
| 32 function mlmmj_boolean($name, $nicename, $text) | |
| 33 { | |
| 34 global $tpl, $topdir, $list, $HTTP_POST_VARS; | |
| 35 | |
| 36 $file = $topdir."/".$list."/control/".$name; | |
| 37 | |
| 38 if (isset($HTTP_POST_VARS[$name])) | |
| 39 { | |
| 40 if(!touch($file)) | |
| 41 die("Couldn't open ".$file." for writing"); | |
| 42 } | |
| 43 else | |
| 44 @unlink($file); | |
| 45 } | |
| 46 | |
| 47 function mlmmj_string ($name, $nicename, $text) | |
| 48 { | |
| 49 mlmmj_list($name, $nicename, $text); | |
| 50 } | |
| 51 | |
| 52 function mlmmj_list($name, $nicename, $text) | |
| 53 { | |
| 54 global $tpl, $topdir, $list,$HTTP_POST_VARS; | |
| 55 | |
| 56 $file = $topdir."/".$list."/control/".$name; | |
| 57 | |
| 58 if(!empty($HTTP_POST_VARS[$name])) | |
| 59 { | |
| 60 if (!$fp = fopen($file, "w")) | |
| 61 die("Couldn't open ".$file." for writing"); | |
| 62 | |
| 63 fwrite($fp, $HTTP_POST_VARS[$name]); | |
| 64 fclose($fp); | |
| 65 } | |
| 66 else | |
| 67 @unlink($file); | |
| 68 | |
| 69 } | |
| 70 | |
| 503 | 71 // Perl's encode_entities (to be able to use tunables.pl) |
| 72 function encode_entities($str) { return htmlentities($str); } | |
| 73 | |
| 74 | |
|
710
6d354f3a8d90
Replaced class.FastTemplate.php with class.rFastTemplate.php in contrib/web/php-admin (Christoph Thiel)
mortenp
parents:
687
diff
changeset
|
75 $tpl = new rFastTemplate($templatedir); |
| 309 | 76 |
| 77 $list = $HTTP_POST_VARS["list"]; | |
| 78 | |
| 384 | 79 if(!isset($list)) |
| 80 die("no list specified"); | |
| 81 | |
|
783
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
82 if (strchr($list, "/") !== false) |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
83 die("slash in list name"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
84 |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
85 if ($list == ".") |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
86 die("list name is dot"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
87 |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
88 if ($list == "..") |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
89 die("list name is dot-dot"); |
|
a50b8ab11d28
Validate input in php-admin to avoid altering arbitrary files
Ben Schmidt
parents:
710
diff
changeset
|
90 |
| 309 | 91 if(!is_dir($topdir."/".$list)) |
| 92 die("non-existent list"); | |
| 93 | |
| 94 $tpl->define(array("main" => "save.html")); | |
| 95 $tpl->assign(array("LIST" => htmlentities($list))); | |
| 96 | |
| 687 | 97 $handle = fopen("$templatedir/../conf/tunables.pl", "r"); |
| 98 $tunables = fread($handle, filesize("$templatedir/../conf/tunables.pl")); | |
| 503 | 99 fclose($handle); |
| 100 | |
| 101 eval($tunables); | |
| 309 | 102 |
| 103 $tpl->parse("MAIN","main"); | |
| 104 $tpl->FastPrint("MAIN"); | |
| 105 | |
| 106 ?> |