Changeset 1028 for trunk/wp-admin/templates.php

Timestamp:

03/29/2004 10:43:07 PM (22 years ago)

Author:

rboren

Message:

Fix security bug in the template editor. ​http://wordpress.org/support/3/3667

File:

• trunk/wp-admin/templates.php (modified) (5 diffs)

trunk/wp-admin/templates.php

@@ -12 +12 @@
         return $array;
 } 
+
+function validate_file($file) {
+        if ('..' == substr($file,0,2))
+                die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.');
+        
+        if (':' == substr($file,1,1))
+                die ('Sorry, can’t call files with their real path.');
+
+        if ('/' == substr($file,0,1))
+                $file = '.' . $file;
+        
+        $file = stripslashes($file);
+        $file = str_replace('../', '', $file);
+
+    return $file;
+}
 
 if (!get_magic_quotes_gpc()) {
@@ -48 +64 @@
         $newcontent = stripslashes($HTTP_POST_VARS['newcontent']);
         $file = $HTTP_POST_VARS['file'];
-        $f = fopen($file, 'w+');
-        fwrite($f, $newcontent);
-        fclose($f);
+    $file = validate_file($file);
+        $real_file = '../' . $file;
+    if (is_writeable($real_file)) {
+        $f = fopen($real_file, 'w+');
+        fwrite($f, $newcontent);
+        fclose($f);
+        header("Location: templates.php?file=$file&a=te");
+    } else {
+        header("Location: templates.php?file=$file");
+    }
 
-        $file = str_replace('../', '', $file);
-        header("Location: templates.php?file=$file&a=te");
         exit();
 
@@ -73 +94 @@
                 }
         }
+
+    $file = validate_file($file);       
+        $real_file = '../' . $file;
         
-        if ('..' == substr($file,0,2))
-                die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.');
-        
-        if (':' == substr($file,1,1))
-                die ('Sorry, can’t call files with their real path.');
-
-        if ('/' == substr($file,0,1))
-                $file = '.' . $file;
-        
-        $file = stripslashes($file);
-        $file = str_replace('../', '', $file);
-        $file = '../' . $file;
-        
-        if (!is_file($file))
+        if (!is_file($real_file))
                 $error = 1;
 
@@ -94 +105 @@
         
         if (!$error) {
-                $f = fopen($file, 'r');
-                $content = fread($f, filesize($file));
+                $f = fopen($real_file, 'r');
+                $content = fread($f, filesize($real_file));
                 $content = htmlspecialchars($content);
 //              $content = str_replace("</textarea","&lt;/textarea",$content);
@@ -115 +126 @@
      <br /> 
      <?php
-                if (is_writeable($file)) {
+                if (is_writeable($real_file)) {
                         echo "<input type='submit' name='submit' value='Update File' tabindex='2' />";
                 } else {