sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix security bug in the template editor. http://wordpress.org/support/3/3667 

git-svn-id: https://develop.svn.wordpress.org/trunk@1028 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2004-03-29 22:43:07 +00:00
parent 4877319023
commit 452c3ddc69
1 changed files with 32 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
wp-admin/templates.php
View File

@ -12,6 +12,22 @@ function add_magic_quotes($array) {
return $array; return $array;
} }
function validate_file($file) {
if ('..' == substr($file,0,2))
die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.');
if (':' == substr($file,1,1))
die ('Sorry, can’t call files with their real path.');
if ('/' == substr($file,0,1))
$file = '.' . $file;
$file = stripslashes($file);
$file = str_replace('../', '', $file);
return $file;
}
if (!get_magic_quotes_gpc()) { if (!get_magic_quotes_gpc()) {
$HTTP_GET_VARS = add_magic_quotes($HTTP_GET_VARS); $HTTP_GET_VARS = add_magic_quotes($HTTP_GET_VARS);
$HTTP_POST_VARS = add_magic_quotes($HTTP_POST_VARS); $HTTP_POST_VARS = add_magic_quotes($HTTP_POST_VARS);
@ -47,12 +63,17 @@ case 'update':
$newcontent = stripslashes($HTTP_POST_VARS['newcontent']); $newcontent = stripslashes($HTTP_POST_VARS['newcontent']);
$file = $HTTP_POST_VARS['file']; $file = $HTTP_POST_VARS['file'];
$f = fopen($file, 'w+'); $file = validate_file($file);
$real_file = '../' . $file;
if (is_writeable($real_file)) {
$f = fopen($real_file, 'w+');
fwrite($f, $newcontent); fwrite($f, $newcontent);
fclose($f); fclose($f);
$file = str_replace('../', '', $file);
header("Location: templates.php?file=$file&a=te"); header("Location: templates.php?file=$file&a=te");
} else {
header("Location: templates.php?file=$file");
}
exit(); exit();
break; break;
@ -73,28 +94,18 @@ default:
} }
} }
if ('..' == substr($file,0,2)) $file = validate_file($file);
die ('Sorry, can’t edit files with ".." in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.'); $real_file = '../' . $file;
if (':' == substr($file,1,1)) if (!is_file($real_file))
die ('Sorry, can’t call files with their real path.');
if ('/' == substr($file,0,1))
$file = '.' . $file;
$file = stripslashes($file);
$file = str_replace('../', '', $file);
$file = '../' . $file;
if (!is_file($file))
$error = 1; $error = 1;
if ((substr($file,0,2) == 'wp') and (substr($file,-4,4) == '.php') and ($file != 'wp.php')) if ((substr($file,0,2) == 'wp') and (substr($file,-4,4) == '.php') and ($file != 'wp.php'))
$warning = ' — this is a WordPress file, be careful when editing it!'; $warning = ' — this is a WordPress file, be careful when editing it!';
if (!$error) { if (!$error) {
$f = fopen($file, 'r'); $f = fopen($real_file, 'r');
$content = fread($f, filesize($file)); $content = fread($f, filesize($real_file));
$content = htmlspecialchars($content); $content = htmlspecialchars($content);
// $content = str_replace("</textarea","&lt;/textarea",$content); // $content = str_replace("</textarea","&lt;/textarea",$content);
} }
@ -114,7 +125,7 @@ default:
<input type="hidden" name="file" value="<?php echo $file ?>" /> <input type="hidden" name="file" value="<?php echo $file ?>" />
<br /> <br />
<?php <?php
if (is_writeable($file)) { if (is_writeable($real_file)) {
echo "<input type='submit' name='submit' value='Update File' tabindex='2' />"; echo "<input type='submit' name='submit' value='Update File' tabindex='2' />";
} else { } else {
echo "<input type='button' name='oops' value='(You cannot update that file/template: must make it writable, e.g. CHMOD 666)' tabindex='2' />"; echo "<input type='button' name='oops' value='(You cannot update that file/template: must make it writable, e.g. CHMOD 666)' tabindex='2' />";