Changeset 1028 for trunk/wp-admin/templates.php

Timestamp:

03/29/2004 10:43:07 PM (22 years ago)

Author:

rboren

Message:

Fix security bug in the template editor. ​http://wordpress.org/support/3/3667

File:

• trunk/wp-admin/templates.php (modified) (5 diffs)

trunk/wp-admin/templates.php

@@ -12 +12 @@
     return $array;
 } 
+
+function validate_file($file) {
+    if ('..' == substr($file,0,2))
+        die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.');
+    
+    if (':' == substr($file,1,1))
+        die ('Sorry, can’t call files with their real path.');
+
+    if ('/' == substr($file,0,1))
+        $file = '.' . $file;
+    
+    $file = stripslashes($file);
+    $file = str_replace('../', '', $file);
+
+    return $file;
+}
 
 if (!get_magic_quotes_gpc()) {
@@ -48 +64 @@
     $newcontent = stripslashes($HTTP_POST_VARS['newcontent']);
     $file = $HTTP_POST_VARS['file'];
-    $f = fopen($file, 'w+');
-    fwrite($f, $newcontent);
-    fclose($f);
+    $file = validate_file($file);
+    $real_file = '../' . $file;
+    if (is_writeable($real_file)) {
+        $f = fopen($real_file, 'w+');
+        fwrite($f, $newcontent);
+        fclose($f);
+        header("Location: templates.php?file=$file&a=te");
+    } else {
+        header("Location: templates.php?file=$file");
+    }
 
-    $file = str_replace('../', '', $file);
-    header("Location: templates.php?file=$file&a=te");
     exit();
 
@@ -73 +94 @@
         }
     }
+
+    $file = validate_file($file);   
+    $real_file = '../' . $file;
     
-    if ('..' == substr($file,0,2))
-        die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.');
-    
-    if (':' == substr($file,1,1))
-        die ('Sorry, can’t call files with their real path.');
-
-    if ('/' == substr($file,0,1))
-        $file = '.' . $file;
-    
-    $file = stripslashes($file);
-    $file = str_replace('../', '', $file);
-    $file = '../' . $file;
-    
-    if (!is_file($file))
+    if (!is_file($real_file))
         $error = 1;
 
@@ -94 +105 @@
     
     if (!$error) {
-        $f = fopen($file, 'r');
-        $content = fread($f, filesize($file));
+        $f = fopen($real_file, 'r');
+        $content = fread($f, filesize($real_file));
         $content = htmlspecialchars($content);
 //      $content = str_replace("</textarea","&lt;/textarea",$content);
@@ -115 +126 @@
      <br /> 
      <?php
-        if (is_writeable($file)) {
+        if (is_writeable($real_file)) {
             echo "<input type='submit' name='submit' value='Update File' tabindex='2' />";
         } else {