Changeset 2019

Timestamp:

12/30/2004 06:05:46 PM (18 years ago)

Author:

rboren

Message:

Do not allow .. anywhere in the filename.

Location:

trunk/wp-admin

Files:

• admin-functions.php (modified) (1 diff)
• admin.php (modified) (1 diff)

trunk/wp-admin/admin-functions.php

@@ -761 +761 @@
 }
 
+function validate_file($file, $allowed_files = '') {
+    if ( false !== strpos($file, './'))
+        return 1;
+    
+    if (':' == substr($file,1,1))
+        return 2;
+
+    if ( !empty($allowed_files) && (! in_array($file, $allowed_files)) )
+        return 3;
+
+    return 0;
+}
+
 function validate_file_to_edit($file, $allowed_files = '') {
-    if ('..' == substr($file,0,2))
+    $file = stripslashes($file);
+
+    $code = validate_file($file, $allowed_files);
+
+    if (! $code)
+        return $file;
+
+    switch ($code) {
+    case 1:
         die (__('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.'));
     
-    if (':' == substr($file,1,1))
+    case 2:
         die (__('Sorry, can’t call files with their real path.'));
 
-    if ( !empty($allowed_files) && (! in_array($file, $allowed_files)) ) {
+    case 3:
         die (__('Sorry, that file cannot be edited.'));
     }
-    
-    $file = stripslashes($file);
-
-    return $file;
 }
 

trunk/wp-admin/admin.php

@@ -43 +43 @@
 if (isset($_GET['page'])) {
     $plugin_page = plugin_basename($_GET['page']);
-    if (! file_exists(ABSPATH . "wp-content/plugins/$plugin_page")) {
-        die(sprintf(__('Cannot load %s.'), $plugin_page));
+    if ( validate_file($plugin_page) ) {
+        die(__('Invalid plugin page'));
     }
 
-    if (! isset($_GET['noheader'])) {
+    if (! file_exists(ABSPATH . "wp-content/plugins/$plugin_page"))
+        die(sprintf(__('Cannot load %s.'), $plugin_page));
+
+    if (! isset($_GET['noheader']))
         require_once(ABSPATH . '/wp-admin/admin-header.php');
-    }
 
     include(ABSPATH . "wp-content/plugins/$plugin_page");