Checking includes for valid paths

diff --git a/boot.php b/boot.php
index 3116bb94b9c188bffa581ef050f4c3fa9d6c8be1..22cd34e062d6fcdb4001a11ea2744b5b00cc1d41 100644 (file)
--- a/boot.php
+++ b/boot.php
@@ -1893,3 +1893,31 @@ if(!function_exists('exif_imagetype')) {
                return($size[2]);
        }
 }
+
+function validate_include(&$file) {
+       $orig_file = $file;
+
+       $file = realpath($file);
+
+       if (strpos($file, getcwd()) !== 0)
+               return false;
+
+       $file = str_replace(getcwd()."/", "", $file, $count);
+       if ($count != 1)
+               return false;
+
+       if ($orig_file !== $file)
+               return false;
+
+       $valid = false;
+       if (strpos($file, "include/") === 0)
+               $valid = true;
+
+       if (strpos($file, "addon/") === 0)
+               $valid = true;
+
+       if (!$valid)
+               return false;
+
+       return true;
+}

diff --git a/include/poller.php b/include/poller.php
index e4b0b092f48ff57033848a2a4699b7c49c4b6124..b03dc84af7cb7158d36c0e06c56ac55ac09c792c 100644 (file)
--- a/include/poller.php
+++ b/include/poller.php
@@ -65,8 +65,16 @@ function poller_run(&$argv, &$argc){
 
                $argc = count($argv);
 
-               // To-Do: Check for existance
-               require_once(basename($argv[0]));
+               // Check for existance and validity of the include file
+               $include = $argv[0];
+
+               if (!validate_include($include)) {
+                       logger("Include file ".$argv[0]." is not valid!");
+                       q("DELETE FROM `workerqueue` WHERE `id` = %d", intval($r[0]["id"]));
+                       continue;
+               }
+
+               require_once($include);
 
                $funcname=str_replace(".php", "", basename($argv[0]))."_run";
 
@@ -77,7 +85,8 @@ function poller_run(&$argv, &$argc){
                        logger("Process ".getmypid().": ".$funcname." - done");
 
                        q("DELETE FROM `workerqueue` WHERE `id` = %d", intval($r[0]["id"]));
-               }
+               } else
+                       logger("Function ".$funcname." does not exist");
        }
 
 }