[0000281] Filename saitization added

diff --git a/admin/attachments.php b/admin/attachments.php
index 30090517cdaad37bf38926089c87d3674c338cd1..d87b510c157d166abccb66edeca7b5cb3ee25ec6 100644 (file)
--- a/admin/attachments.php
+++ b/admin/attachments.php
@@ -94,8 +94,11 @@ if ($Mode == 'ADD_ITEM' || $Mode == 'UPDATE_ITEM')
                        fwrite($fp, $index_file);
                        fclose($fp);
                }
-               if ($Mode == 'UPDATE_ITEM' && file_exists($dir."/".$_POST['unique_name']))
-                       unlink($dir."/".$_POST['unique_name']);
+               // file name compatible with POSIX
+               // protect against directory traversal
+               $unique_name = preg_replace('/[^a-zA-Z0-9.\-_]/', '', $_POST['unique_name']);
+               if ($Mode == 'UPDATE_ITEM' && file_exists($dir."/".$unique_name))
+                       unlink($dir."/".$unique_name);
 
                $unique_name = uniqid('');
                move_uploaded_file($tmpname, $dir."/".$unique_name);

diff --git a/admin/db/maintenance_db.inc b/admin/db/maintenance_db.inc
index e453c97bc537effdbddc3f02f031bbb4193eec9c..81fc0abc0f764f8c4d140a13ad3bca26ec65c17d 100644 (file)
--- a/admin/db/maintenance_db.inc
+++ b/admin/db/maintenance_db.inc
@@ -438,7 +438,7 @@ function db_backup($conn, $ext='no', $comm='', $tbpref = TB_PREF)
        else
                $filename = $conn['dbname'] . "_" . date("Ymd_Hi") . ".sql";
 
-       return db_export($conn, $filename, $ext, $comm, $tbpref);
+       return db_export($conn, clean_file_name($filename), $ext, $comm, $tbpref);
 }
 
 // generates a dump of $db database

diff --git a/includes/main.inc b/includes/main.inc
index b89f4496d4cc5ac0699aa3a30b8cc4224d0fccbc..3d94aeb6900d1a85583ece6eef587f33015c96b9 100644 (file)
--- a/includes/main.inc
+++ b/includes/main.inc
@@ -343,5 +343,13 @@ function find_custom_file($rep)
 
        return null;
 }
+/*
+       
+       Protect against directory traversal.
+       Changes all not POSIX compatible chars to underscore.
+*/
+function clean_file_name($filename) {
+    return preg_replace('/[^a-zA-Z0-9.\-_]/', '_', $filename);
+}
 
 ?>
\ No newline at end of file