Changeset 4226

Timestamp:

09/25/2006 01:48:48 AM (20 years ago)

Author:

ryan

Message:

Validate backup and fragment files. Don't allow traversal.

File:

• branches/2.0/wp-content/plugins/wp-db-backup.php (modified) (3 diffs)

branches/2.0/wp-content/plugins/wp-db-backup.php

@@ -70 +70 @@
                         
                         $this->backup_file = $_GET['backup'];
-                        
+                        $this->validate_file($this->backup_file);
+
                         switch($via) {
                         case 'smtp':
@@ -96 +97 @@
                 if (isset($_GET['fragment'] )) {
                         list($table, $segment, $filename) = explode(':', $_GET['fragment']);
+                        $this->validate_file($filename);
                         $this->backup_fragment($table, $segment, $filename);
                 }
@@ -882 +884 @@
                 return;
         } // wp_cron_db_backup
+
+        function validate_file($file) {
+                if (false !== strpos($file, '..'))
+                        die(__("Cheatin' uh ?"));
+
+                if (false !== strpos($file, './'))
+                        die(__("Cheatin' uh ?"));
+
+                if (':' == substr($file, 1, 1))
+                        die(__("Cheatin' uh ?"));
+        }
+
 }