Skip to content

Commit d7ead2f

Browse files
committed
Security: Clean path when upload files to avoid arbitrary file write
1 parent c9f912b commit d7ead2f

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

main/inc/lib/fileUpload.lib.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ function handle_uploaded_document(
343343
}
344344

345345
// Full path to where we want to store the file with trailing slash
346-
$whereToSave = $documentDir.$uploadPath;
346+
$whereToSave = Security::cleanPath($documentDir.$uploadPath).'/';
347347

348348
// At least if the directory doesn't exist, tell so
349349
if (!is_dir($whereToSave)) {

main/inc/lib/security.lib.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,7 @@ public static function check_abs_path(string $abs_path, string $checker_path): b
6464
}
6565

6666
// Clean $abs_path.
67-
$abs_path = str_replace(['//', '../'], ['/', ''], $abs_path);
68-
$true_path = str_replace("\\", '/', realpath($abs_path));
67+
$true_path = self::cleanPath($abs_path);
6968
$checker_path = str_replace("\\", '/', realpath($checker_path));
7069

7170
if (empty($checker_path)) {
@@ -89,6 +88,13 @@ public static function check_abs_path(string $abs_path, string $checker_path): b
8988
return false;
9089
}
9190

91+
public static function cleanPath(string $absPath): string
92+
{
93+
$absPath = str_replace(['//', '../'], ['/', ''], $absPath);
94+
95+
return str_replace("\\", '/', realpath($absPath));
96+
}
97+
9298
/**
9399
* Checks if the relative path (directory) given is really under the
94100
* checker path (directory).

0 commit comments

Comments
 (0)