Sanitize addon path items

diff --git a/src/Core/Addon.php b/src/Core/Addon.php
index 7957e08350efefb0cd68c39287b4bd3c7a903fc4..06a731b2cdd594b4b6cebba0e542e06bd69a01b2 100644 (file)
--- a/src/Core/Addon.php
+++ b/src/Core/Addon.php
@@ -6,6 +6,7 @@ namespace Friendica\Core;
 
 use Friendica\BaseObject;
 use Friendica\Database\DBA;
+use Friendica\Util\Strings;
 
 /**
  * Some functions to handle addons
@@ -81,6 +82,8 @@ class Addon extends BaseObject
         */
        public static function uninstall($addon)
        {
+               $addon = Strings::sanitizeFilePathItem($addon);
+
                Logger::notice("Addon {addon}: {action}", ['action' => 'uninstall', 'addon' => $addon]);
                DBA::delete('addon', ['name' => $addon]);
 
@@ -102,11 +105,13 @@ class Addon extends BaseObject
         */
        public static function install($addon)
        {
-               // silently fail if addon was removed
+               $addon = Strings::sanitizeFilePathItem($addon);
 
+               // silently fail if addon was removed of if $addon is funky
                if (!file_exists('addon/' . $addon . '/' . $addon . '.php')) {
                        return false;
                }
+
                Logger::notice("Addon {addon}: {action}", ['action' => 'install', 'addon' => $addon]);
                $t = @filemtime('addon/' . $addon . '/' . $addon . '.php');
                @include_once('addon/' . $addon . '/' . $addon . '.php');
@@ -130,6 +135,7 @@ class Addon extends BaseObject
                        if (!self::isEnabled($addon)) {
                                self::$addons[] = $addon;
                        }
+
                        return true;
                } else {
                        Logger::error("Addon {addon}: {action} failed", ['action' => 'uninstall', 'addon' => $addon]);
@@ -153,29 +159,26 @@ class Addon extends BaseObject
 
                        $addon_list = explode(',', $addons);
 
-                       if (count($addon_list)) {
-                               foreach ($addon_list as $addon) {
-                                       $addon = trim($addon);
-                                       $fname = 'addon/' . $addon . '/' . $addon . '.php';
-
-                                       if (file_exists($fname)) {
-                                               $t = @filemtime($fname);
-                                               foreach ($installed as $i) {
-                                                       if (($i['name'] == $addon) && ($i['timestamp'] != $t)) {
-
-                                                               Logger::notice("Addon {addon}: {action}", ['action' => 'reload', 'addon' => $i['name']]);
-                                                               @include_once($fname);
-
-                                                               if (function_exists($addon . '_uninstall')) {
-                                                                       $func = $addon . '_uninstall';
-                                                                       $func(self::getApp());
-                                                               }
-                                                               if (function_exists($addon . '_install')) {
-                                                                       $func = $addon . '_install';
-                                                                       $func(self::getApp());
-                                                               }
-                                                               DBA::update('addon', ['timestamp' => $t], ['id' => $i['id']]);
+                       foreach ($addon_list as $addon) {
+                               $addon = Strings::sanitizeFilePathItem(trim($addon));
+                               $fname = 'addon/' . $addon . '/' . $addon . '.php';
+                               if (file_exists($fname)) {
+                                       $t = @filemtime($fname);
+                                       foreach ($installed as $i) {
+                                               if (($i['name'] == $addon) && ($i['timestamp'] != $t)) {
+
+                                                       Logger::notice("Addon {addon}: {action}", ['action' => 'reload', 'addon' => $i['name']]);
+                                                       @include_once($fname);
+
+                                                       if (function_exists($addon . '_uninstall')) {
+                                                               $func = $addon . '_uninstall';
+                                                               $func(self::getApp());
+                                                       }
+                                                       if (function_exists($addon . '_install')) {
+                                                               $func = $addon . '_install';
+                                                               $func(self::getApp());
                                                        }
+                                                       DBA::update('addon', ['timestamp' => $t], ['id' => $i['id']]);
                                                }
                                        }
                                }
@@ -204,6 +207,8 @@ class Addon extends BaseObject
        {
                $a = self::getApp();
 
+               $addon = Strings::sanitizeFilePathItem($addon);
+
                $info = [
                        'name' => $addon,
                        'description' => "",

diff --git a/src/Core/Hook.php b/src/Core/Hook.php
index 7f0c015b3db155ae500b3ded2d06ecf0837c20d7..5caa54319429df3ff4a81668a7517ca59c02549b 100644 (file)
--- a/src/Core/Hook.php
+++ b/src/Core/Hook.php
@@ -7,6 +7,7 @@ namespace Friendica\Core;
 use Friendica\App;
 use Friendica\BaseObject;
 use Friendica\Database\DBA;
+use Friendica\Util\Strings;
 
 /**
  * Some functions to handle hooks
@@ -215,6 +216,8 @@ class Hook extends BaseObject
         */
        public static function isAddonApp($name)
        {
+               $name = Strings::sanitizeFilePathItem($name);
+
                if (array_key_exists('app_menu', self::$hooks)) {
                        foreach (self::$hooks['app_menu'] as $hook) {
                                if ($hook[0] == 'addon/' . $name . '/' . $name . '.php') {

diff --git a/src/Core/L10n.php b/src/Core/L10n.php
index f7ed9918ce7bd8feb139774ab2676074aed1aff9..ae0ed18c3d0a732364bfc5d53ca072f935f253cf 100644 (file)
--- a/src/Core/L10n.php
+++ b/src/Core/L10n.php
@@ -6,6 +6,7 @@ namespace Friendica\Core;
 
 use Friendica\BaseObject;
 use Friendica\Database\DBA;
+use Friendica\Util\Strings;
 
 /**
  * Provide Language, Translation, and Localization functions to the application
@@ -193,6 +194,8 @@ class L10n extends BaseObject
         */
        private static function loadTranslationTable($lang)
        {
+               $lang = Strings::sanitizeFilePathItem($lang);
+
                if ($lang === self::$lang) {
                        return;
                }
@@ -203,7 +206,7 @@ class L10n extends BaseObject
                // load enabled addons strings
                $addons = DBA::select('addon', ['name'], ['installed' => true]);
                while ($p = DBA::fetch($addons)) {
-                       $name = $p['name'];
+                       $name = Strings::sanitizeFilePathItem($p['name']);
                        if (file_exists("addon/$name/lang/$lang/strings.php")) {
                                include "addon/$name/lang/$lang/strings.php";
                        }