Sanitize theme path items

- Sanitize theme style/color/scheme path items

diff --git a/mod/settings.php b/mod/settings.php
index b1be28f8c908d11471a435358025b2a072679d21..536c8335422124f6ba1ffd5291d7c31234832c55 100644 (file)
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -30,6 +30,8 @@ use Friendica\Util\Temporal;
 
 function get_theme_config_file($theme)
 {
+       $theme = Strings::sanitizeFilePathItem($theme);
+
        $a = \get_app();
        $base_theme = defaults($a->theme_info, 'extends');
 
@@ -877,40 +879,30 @@ function settings_content(App $a)
                        $default_mobile_theme = 'none';
                }
 
-               $allowed_themes_str = Config::get('system', 'allowed_themes');
-               $allowed_themes_raw = explode(',', $allowed_themes_str);
-               $allowed_themes = [];
-               if (count($allowed_themes_raw)) {
-                       foreach ($allowed_themes_raw as $x) {
-                               if (strlen(trim($x)) && is_dir("view/theme/$x")) {
-                                       $allowed_themes[] = trim($x);
-                               }
-                       }
-               }
-
+               $allowed_themes = Theme::getAllowedList();
 
                $themes = [];
                $mobile_themes = ["---" => L10n::t('No special theme for mobile devices')];
-               if ($allowed_themes) {
-                       foreach ($allowed_themes as $theme) {
-                               $is_experimental = file_exists('view/theme/' . $theme . '/experimental');
-                               $is_unsupported  = file_exists('view/theme/' . $theme . '/unsupported');
-                               $is_mobile       = file_exists('view/theme/' . $theme . '/mobile');
-                               if (!$is_experimental || ($is_experimental && (Config::get('experimentals', 'exp_themes')==1 || is_null(Config::get('experimentals', 'exp_themes'))))) {
-                                       $theme_name = ucfirst($theme);
-                                       if ($is_unsupported) {
-                                               $theme_name = L10n::t("%s - \x28Unsupported\x29", $theme_name);
-                                       } elseif ($is_experimental) {
-                                               $theme_name = L10n::t("%s - \x28Experimental\x29", $theme_name);
-                                       }
-                                       if ($is_mobile) {
-                                               $mobile_themes[$theme] = $theme_name;
-                                       } else {
-                                               $themes[$theme] = $theme_name;
-                                       }
+               foreach ($allowed_themes as $theme) {
+                       $is_experimental = file_exists('view/theme/' . $theme . '/experimental');
+                       $is_unsupported  = file_exists('view/theme/' . $theme . '/unsupported');
+                       $is_mobile       = file_exists('view/theme/' . $theme . '/mobile');
+                       if (!$is_experimental || ($is_experimental && (Config::get('experimentals', 'exp_themes')==1 || is_null(Config::get('experimentals', 'exp_themes'))))) {
+                               $theme_name = ucfirst($theme);
+                               if ($is_unsupported) {
+                                       $theme_name = L10n::t('%s - (Unsupported)', $theme_name);
+                               } elseif ($is_experimental) {
+                                       $theme_name = L10n::t('%s - (Experimental)', $theme_name);
+                               }
+
+                               if ($is_mobile) {
+                                       $mobile_themes[$theme] = $theme_name;
+                               } else {
+                                       $themes[$theme] = $theme_name;
                                }
                        }
                }
+
                $theme_selected        = defaults($_SESSION, 'theme'       , $default_theme);
                $mobile_theme_selected = defaults($_SESSION, 'mobile-theme', $default_mobile_theme);
 

diff --git a/mod/view.php b/mod/view.php
index f4f1692cb6ffdfcdb9b9689c620191ff001c6e08..6f23d84dc45f776627578a8f5413f528cbfaadad 100644 (file)
--- a/mod/view.php
+++ b/mod/view.php
@@ -1,6 +1,7 @@
 <?php
 
 use Friendica\App;
+use Friendica\Util\Strings;
 
 /**
  * load view/theme/$current_theme/style.php with friendica context
@@ -10,14 +11,17 @@ use Friendica\App;
 function view_init(App $a)
 {
        header("Content-Type: text/css");
-               
-       if ($a->argc == 4){
+
+       if ($a->argc == 4) {
                $theme = $a->argv[2];
+               $theme = Strings::sanitizeFilePathItem($theme);
+
                // set the path for later use in the theme styles
                $THEMEPATH = "view/theme/$theme";
-               if(file_exists("view/theme/$theme/style.php"))
+               if (file_exists("view/theme/$theme/style.php")) {
                        require_once("view/theme/$theme/style.php");
+               }
        }
-       
+
        exit();
 }

diff --git a/src/App.php b/src/App.php
index f4fb3fa3d99f510a3c8c2b76266d278b340bbbf2..7ed0377130268b9c44669428ae35f291749322cc 100644 (file)
--- a/src/App.php
+++ b/src/App.php
@@ -10,12 +10,14 @@ use DOMXPath;
 use Exception;
 use Friendica\Core\Config\Cache\IConfigCache;
 use Friendica\Core\Config\Configuration;
+use Friendica\Core\Theme;
 use Friendica\Database\DBA;
 use Friendica\Model\Profile;
 use Friendica\Network\HTTPException\InternalServerErrorException;
 use Friendica\Util\Config\ConfigFileLoader;
 use Friendica\Util\HTTPSignature;
 use Friendica\Util\Profiler;
+use Friendica\Util\Strings;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -975,8 +977,6 @@ class App
                // Sane default
                $this->currentTheme = $system_theme;
 
-               $allowed_themes = explode(',', $this->config->get('system', 'allowed_themes', $system_theme));
-
                $page_theme = null;
                // Find the theme that belongs to the user whose stuff we are looking at
                if ($this->profile_uid && ($this->profile_uid != local_user())) {
@@ -1007,8 +1007,9 @@ class App
                        $theme_name = $user_theme;
                }
 
+               $theme_name = Strings::sanitizeFilePathItem($theme_name);
                if ($theme_name
-                       && in_array($theme_name, $allowed_themes)
+                       && in_array($theme_name, Theme::getAllowedList())
                        && (file_exists('view/theme/' . $theme_name . '/style.css')
                        || file_exists('view/theme/' . $theme_name . '/style.php'))
                ) {

diff --git a/src/Core/Theme.php b/src/Core/Theme.php
index 02ffe3ada47e1ff3bf470d73dd87217c361a86a0..c972e09fc71a659c085a7a0288c7b69f3391d19c 100644 (file)
--- a/src/Core/Theme.php
+++ b/src/Core/Theme.php
@@ -8,6 +8,7 @@ namespace Friendica\Core;
 
 use Friendica\BaseObject;
 use Friendica\Model\Profile;
+use Friendica\Util\Strings;
 
 require_once 'boot.php';
 
@@ -50,6 +51,8 @@ class Theme
         */
        public static function getInfo($theme)
        {
+               $theme = Strings::sanitizeFilePathItem($theme);
+
                $info = [
                        'name' => $theme,
                        'description' => "",
@@ -113,31 +116,37 @@ class Theme
         */
        public static function getScreenshot($theme)
        {
+               $theme = Strings::sanitizeFilePathItem($theme);
+
                $exts = ['.png', '.jpg'];
                foreach ($exts as $ext) {
                        if (file_exists('view/theme/' . $theme . '/screenshot' . $ext)) {
-                               return(System::baseUrl() . '/view/theme/' . $theme . '/screenshot' . $ext);
+                               return System::baseUrl() . '/view/theme/' . $theme . '/screenshot' . $ext;
                        }
                }
-               return(System::baseUrl() . '/images/blank.png');
+               return System::baseUrl() . '/images/blank.png';
        }
 
-       // install and uninstall theme
        public static function uninstall($theme)
        {
-               Logger::log("Addons: uninstalling theme " . $theme);
+               $theme = Strings::sanitizeFilePathItem($theme);
 
-               include_once "view/theme/$theme/theme.php";
-               if (function_exists("{$theme}_uninstall")) {
-                       $func = "{$theme}_uninstall";
-                       $func();
+               // silently fail if theme was removed or if $theme is funky
+               if (file_exists("view/theme/$theme/theme.php")) {
+                       Logger::log("Addons: uninstalling theme " . $theme);
+
+                       if (function_exists("{$theme}_uninstall")) {
+                               $func = "{$theme}_uninstall";
+                               $func();
+                       }
                }
        }
 
        public static function install($theme)
        {
-               // silently fail if theme was removed
+               $theme = Strings::sanitizeFilePathItem($theme);
 
+               // silently fail if theme was removed or if $theme is funky
                if (!file_exists("view/theme/$theme/theme.php")) {
                        return false;
                }
@@ -183,10 +192,10 @@ class Theme
                        $parent = 'NOPATH';
                }
                $theme = \get_app()->getCurrentTheme();
-               $thname = $theme;
+               $parent = Strings::sanitizeFilePathItem($parent);
                $ext = substr($file, strrpos($file, '.') + 1);
                $paths = [
-                       "{$root}view/theme/$thname/$ext/$file",
+                       "{$root}view/theme/$theme/$ext/$file",
                        "{$root}view/theme/$parent/$ext/$file",
                        "{$root}view/$ext/$file",
                ];
@@ -212,6 +221,8 @@ class Theme
         */
        public static function getStylesheetPath($theme)
        {
+               $theme = Strings::sanitizeFilePathItem($theme);
+
                if (!file_exists('view/theme/' . $theme . '/style.php')) {
                        return 'view/theme/' . $theme . '/style.css';
                }

diff --git a/view/theme/frio/README.md b/view/theme/frio/README.md
index 6a114eecc2ea9192f4c693871f1191e01f684326..0100baa1d56a581ba718bd9330a1c4a4a9cfae3d 100644 (file)
--- a/view/theme/frio/README.md
+++ b/view/theme/frio/README.md
@@ -2,7 +2,7 @@
 ### A bootstrap based theme for friendica
 This Theme was started as an experiment to give the user a good looking and modern theme for friendica.
 
-I conentrated on 3 topics:
+I concentrated on 3 topics:
 
 1. A Modern, mobile friendly UI with bootstrap and awesome font
 2. Try to get a new UX for friendica (e.g. use modals where it seems to be useful)

diff --git a/view/theme/frio/php/scheme.php b/view/theme/frio/php/scheme.php
index f3150b52f383092f011c9a4c5fb06859e743a1fb..fa933bd9411a1b28b8df9b57a6d259cfd2d42b2b 100644 (file)
--- a/view/theme/frio/php/scheme.php
+++ b/view/theme/frio/php/scheme.php
@@ -19,6 +19,7 @@
  */
 
 use Friendica\Core\PConfig;
+use Friendica\Util\Strings;
 
 function get_scheme_info($scheme)
 {
@@ -28,6 +29,8 @@ function get_scheme_info($scheme)
                $scheme = PConfig::get(local_user(), 'frio', 'scheme', PConfig::get(local_user(), 'frio', 'schema'));
        }
 
+       $scheme = Strings::sanitizeFilePathItem($scheme);
+
        $info = [
                'name' => $scheme,
                'description' => '',

diff --git a/view/theme/frio/style.php b/view/theme/frio/style.php
index 5fada9dd4802dc51d0e19aa17aebdbf6e4deea46..6a8aaf2c2819fcd06e1e292573c4b1934b421be1 100644 (file)
--- a/view/theme/frio/style.php
+++ b/view/theme/frio/style.php
@@ -5,9 +5,11 @@
 
 use Friendica\Core\Config;
 use Friendica\Core\PConfig;
+use Friendica\Util\Strings;
 
 require_once 'view/theme/frio/php/PHPColors/Color.php';
 
+$scheme = '';
 $schemecss = '';
 $schemecssfile = false;
 $scheme_modified = 0;
@@ -67,9 +69,7 @@ if (!empty($_REQUEST['scheme'])) {
        $scheme = $_REQUEST['scheme'];
 }
 
-// Sanitize the data.
-$scheme = !empty($scheme) ? basename($scheme) : '';
-
+$scheme = Strings::sanitizeFilePathItem($scheme);
 
 if (($scheme) && ($scheme != '---')) {
        if (file_exists('view/theme/frio/scheme/' . $scheme . '.php')) {

diff --git a/view/theme/quattro/style.php b/view/theme/quattro/style.php
index 08756ec4aa63bc16685d2b6aacccbc102d3e93d6..cca458a254ff4529b84d7bc3ca0c9cf646fe38f5 100644 (file)
--- a/view/theme/quattro/style.php
+++ b/view/theme/quattro/style.php
@@ -26,6 +26,8 @@ if ($quattro_align === false) {
        $quattro_align = $site_quattro_align;
 }
 
+$color = \Friendica\Util\Strings::sanitizeFilePathItem($color);
+
 if (file_exists("$THEMEPATH/$color/style.css")) {
        echo file_get_contents("$THEMEPATH/$color/style.css");
 }

diff --git a/view/theme/vier/style.php b/view/theme/vier/style.php
index 4dfbe4e268f1a837c1b1f2adc15c4ee09c454fcd..69bfc78d88abfff0347a98c99db71df7b4f4b921 100644 (file)
--- a/view/theme/vier/style.php
+++ b/view/theme/vier/style.php
@@ -22,6 +22,8 @@ if (empty($style)) {
 $stylecss = '';
 $modified = '';
 
+$style = \Friendica\Util\Strings::sanitizeFilePathItem($style);
+
 foreach (['style', $style] as $file) {
        $stylecssfile = $THEMEPATH . DIRECTORY_SEPARATOR . $file .'.css';
        if (file_exists($stylecssfile)) {