prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

little more security for config values

Browse source
This commit is contained in:
Max Pozdeev 2020-09-12 17:02:15 +03:00
parent dbfa448576
commit 734c407917
7 changed files with 37 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/export.php
View file

@ -57,7 +57,7 @@ function printCSV($listData, $data)
($r['d_completed'] ? date('Y-m-d H:i:s O',$r['d_completed']) :''). "\n";
}
header('Content-type: text/csv; charset=utf-8');
header('Content-disposition: attachment; filename=list_'.$listData['id'].'.csv');
header('Content-disposition: attachment; filename=list_'.(int)$listData['id'].'.csv');
print $s;
}
@ -133,7 +133,7 @@ function printICal($listData, $data)
}
$s .= "END:VCALENDAR\r\n";
header('Content-type: text/calendar; charset=utf-8');
header('Content-disposition: attachment; filename=list_'.$listData['id'].'.ics');
header('Content-disposition: attachment; filename=list_'.(int)$listData['id'].'.ics');
print $s;
}

2
src/feed.php
View file

@ -69,7 +69,7 @@ printRss($listData, $data);
function printRss($listData, $data)
{
$link = get_mttinfo('url'). "?list=". $listData['id'];
$link = get_mttinfo('url'). "?list=". (int)$listData['id'];
$buildDate = gmdate('r');
$s = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<rss version=\"2.0\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\">\n<channel>\n".

9
src/includes/common.php
View file

@ -127,6 +127,15 @@ class Config
elseif(isset(self::$params[$key])) return self::$params[$key]['default'];
else return null;
}
public static function getUrl($key)
{
$url = '';
if ( isset(self::$config[$key]) ) $url = self::$config[$key];
else if( isset(self::$params[$key]) ) $url = self::$params[$key]['default'];
else return null;
return str_replace( ["\r","\n"], '', $url );
}
public static function set($key, $value)
{

4
src/index.php
View file

@ -50,7 +50,7 @@ require(TEMPLATEPATH. 'index.php');
function redirectWithHashRoute(array $q, array $hash)
{
$url = get_mttinfo('url');
$url = get_unsafe_mttinfo('url');
$query = http_build_query($q);
if ($query != '') $url .= "?$query";
if (count($hash) > 0) {
@ -71,6 +71,6 @@ function is_mobile()
function getDesktopUrl($escape = true)
{
$url = (Config::get('detectmobile') && is_mobile()) ? get_mttinfo('desktop_url') : get_mttinfo('url');
$url = (Config::get('detectmobile') && is_mobile()) ? get_unsafe_mttinfo('desktop_url') : get_unsafe_mttinfo('url');
return $escape ? htmlspecialchars($url) : $url;
}

37
src/init.php
View file

@ -75,7 +75,7 @@ if (need_auth() && !isset($dontStartSession))
ini_set('session.use_cookies', true);
ini_set('session.use_only_cookies', true);
session_set_cookie_params(1209600, url_dir(Config::get('url')=='' ? getRequestUri() : Config::get('url'))); # 14 days session cookie lifetime
session_set_cookie_params(1209600, url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'))); # 14 days session cookie lifetime
session_name('mtt-session');
session_start();
}
@ -133,17 +133,17 @@ function __($s)
return Lang::instance()->get($s);
}
function mttinfo($v)
function mttinfo($v, $escape = true)
{
global $_mttinfo;
if(!isset($_mttinfo[$v])) {
echo get_mttinfo($v);
} else {
echo $_mttinfo[$v];
}
echo $escape ? get_mttinfo($v) : get_unsafe_mttinfo($v);
}
function get_mttinfo($v)
/*
* Returned values from get_unsafe_mttinfo() can be unsafe for html.
* But '\r' and '\n' in URLs taken from config are removed.
*/
function get_unsafe_mttinfo($v)
{
global $_mttinfo;
if (isset($_mttinfo[$v])) {
@ -152,13 +152,13 @@ function get_mttinfo($v)
switch($v)
{
case 'template_url':
$_mttinfo['template_url'] = get_mttinfo('mtt_url'). 'themes/'. Config::get('template') . '/';
$_mttinfo['template_url'] = get_unsafe_mttinfo('mtt_url'). 'themes/'. Config::get('template') . '/';
return $_mttinfo['template_url'];
case 'includes_url':
$_mttinfo['includes_url'] = get_mttinfo('mtt_url'). 'includes/';
$_mttinfo['includes_url'] = get_unsafe_mttinfo('mtt_url'). 'includes/';
return $_mttinfo['includes_url'];
case 'url':
$_mttinfo['url'] = Config::get('url'); // need to have a trailing slash
$_mttinfo['url'] = Config::getUrl('url'); // need to have a trailing slash
if ($_mttinfo['url'] == '') {
$proto = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != '' && $_SERVER['HTTPS'] != 'off') ? 'https://' : 'http://';
$defport = ($proto == 'https://') ? 443 : 80;
@ -166,22 +166,22 @@ function get_mttinfo($v)
}
return $_mttinfo['url'];
case 'mobile_url':
$_mttinfo['mobile_url'] = Config::get('mobile_url');
$_mttinfo['mobile_url'] = Config::getUrl('mobile_url');
if ($_mttinfo['mobile_url'] == '') {
$_mttinfo['mobile_url'] = get_mttinfo('url'). '?mobile';
$_mttinfo['mobile_url'] = get_unsafe_mttinfo('url'). '?mobile';
}
return $_mttinfo['mobile_url'];
case 'desktop_url':
$_mttinfo['desktop_url'] = get_mttinfo('url'). '?desktop';
$_mttinfo['desktop_url'] = get_unsafe_mttinfo('url'). '?desktop';
return $_mttinfo['desktop_url'];
case 'mtt_url':
$_mttinfo['mtt_url'] = Config::get('mtt_url'); // need to have a trailing slash
$_mttinfo['mtt_url'] = Config::getUrl('mtt_url'); // need to have a trailing slash
if ($_mttinfo['mtt_url'] == '') {
$_mttinfo['mtt_url'] = url_dir(getRequestUri());
}
return $_mttinfo['mtt_url'];
case 'title':
$_mttinfo['title'] = (Config::get('title') != '') ? htmlarray(Config::get('title')) : __('My Tiny Todolist');
$_mttinfo['title'] = (Config::get('title') != '') ? Config::get('title') : __('My Tiny Todolist');
return $_mttinfo['title'];
case 'version':
if (MTT_VERSION != '@VERSION') {
@ -192,6 +192,11 @@ function get_mttinfo($v)
}
}
function get_mttinfo($v)
{
return htmlspecialchars( get_unsafe_mttinfo($v) );
}
function getRequestUri()
{
// Do not use HTTP_X_REWRITE_URL due to CVE-2018-14773

2
src/settings.php
View file

@ -25,7 +25,7 @@ if(isset($_POST['save']))
// in Demo mode we can set only language by cookies
if(defined('MTTDEMO')) {
setcookie('lang', Config::get('lang'), 0, url_dir(Config::get('url')=='' ? $_SERVER['REQUEST_URI'] : Config::get('url')));
setcookie('lang', Config::get('lang'), 0, url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url')));
$t['saved'] = 1;
jsonExit($t);
}

2
src/themes/default/index.php
View file

@ -26,7 +26,7 @@
<script type="text/javascript">
$().ready(function(){
mytinytodo.init({
title: "<?php mttinfo('title'); ?>",
title: "<?php mttinfo('title', false); ?>",
lang: <?php echo Lang::instance()->makeJS() ?>,
mttUrl: "<?php mttinfo('mtt_url'); ?>",
db: mytinytodoStorageAjax,