mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid directory traversal when reading package xml files, also check if file exists before try to read it

Browse Source
This commit is contained in:
Renato Botelho 2014-06-17 10:33:05 -03:00
parent d09ff9ef32
commit 69eb2e295f
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
usr/local/www/pkg_edit.php
View File

@ -65,9 +65,14 @@ function domTT_title($title_msg){
$xml = htmlspecialchars($_GET['xml']);
if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']);
if($xml == "") {
$xml = basename($xml);
if ($xml == "") {
print_info_box_np(gettext("ERROR: No package defined."));
die;
} else if (!file_exists('/usr/local/pkg/' . $xml)) {
print_info_box_np(gettext("ERROR: XML file not found"));
die;
} else {
$pkg = parse_xml_config_pkg("/usr/local/pkg/" . $xml, "packagegui");
}