From 734c4079171f7e7140940a95c22200582815a933 Mon Sep 17 00:00:00 2001 From: Max Pozdeev Date: Sat, 12 Sep 2020 17:02:15 +0300 Subject: [PATCH] little more security for config values --- src/export.php | 4 ++-- src/feed.php | 2 +- src/includes/common.php | 9 +++++++++ src/index.php | 4 ++-- src/init.php | 37 ++++++++++++++++++++---------------- src/settings.php | 2 +- src/themes/default/index.php | 2 +- 7 files changed, 37 insertions(+), 23 deletions(-) diff --git a/src/export.php b/src/export.php index 0a07ed0..5a6a65c 100644 --- a/src/export.php +++ b/src/export.php @@ -57,7 +57,7 @@ function printCSV($listData, $data) ($r['d_completed'] ? date('Y-m-d H:i:s O',$r['d_completed']) :''). "\n"; } header('Content-type: text/csv; charset=utf-8'); - header('Content-disposition: attachment; filename=list_'.$listData['id'].'.csv'); + header('Content-disposition: attachment; filename=list_'.(int)$listData['id'].'.csv'); print $s; } @@ -133,7 +133,7 @@ function printICal($listData, $data) } $s .= "END:VCALENDAR\r\n"; header('Content-type: text/calendar; charset=utf-8'); - header('Content-disposition: attachment; filename=list_'.$listData['id'].'.ics'); + header('Content-disposition: attachment; filename=list_'.(int)$listData['id'].'.ics'); print $s; } diff --git a/src/feed.php b/src/feed.php index f617530..8083e9b 100644 --- a/src/feed.php +++ b/src/feed.php @@ -69,7 +69,7 @@ printRss($listData, $data); function printRss($listData, $data) { - $link = get_mttinfo('url'). "?list=". $listData['id']; + $link = get_mttinfo('url'). "?list=". (int)$listData['id']; $buildDate = gmdate('r'); $s = "\n\n\n". diff --git a/src/includes/common.php b/src/includes/common.php index b73b375..34e776d 100644 --- a/src/includes/common.php +++ b/src/includes/common.php @@ -127,6 +127,15 @@ class Config elseif(isset(self::$params[$key])) return self::$params[$key]['default']; else return null; } + + public static function getUrl($key) + { + $url = ''; + if ( isset(self::$config[$key]) ) $url = self::$config[$key]; + else if( isset(self::$params[$key]) ) $url = self::$params[$key]['default']; + else return null; + return str_replace( ["\r","\n"], '', $url ); + } public static function set($key, $value) { diff --git a/src/index.php b/src/index.php index 81f16cf..87a1936 100644 --- a/src/index.php +++ b/src/index.php @@ -50,7 +50,7 @@ require(TEMPLATEPATH. 'index.php'); function redirectWithHashRoute(array $q, array $hash) { - $url = get_mttinfo('url'); + $url = get_unsafe_mttinfo('url'); $query = http_build_query($q); if ($query != '') $url .= "?$query"; if (count($hash) > 0) { @@ -71,6 +71,6 @@ function is_mobile() function getDesktopUrl($escape = true) { - $url = (Config::get('detectmobile') && is_mobile()) ? get_mttinfo('desktop_url') : get_mttinfo('url'); + $url = (Config::get('detectmobile') && is_mobile()) ? get_unsafe_mttinfo('desktop_url') : get_unsafe_mttinfo('url'); return $escape ? htmlspecialchars($url) : $url; } \ No newline at end of file diff --git a/src/init.php b/src/init.php index 041beab..ac4d41a 100644 --- a/src/init.php +++ b/src/init.php @@ -75,7 +75,7 @@ if (need_auth() && !isset($dontStartSession)) ini_set('session.use_cookies', true); ini_set('session.use_only_cookies', true); - session_set_cookie_params(1209600, url_dir(Config::get('url')=='' ? getRequestUri() : Config::get('url'))); # 14 days session cookie lifetime + session_set_cookie_params(1209600, url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'))); # 14 days session cookie lifetime session_name('mtt-session'); session_start(); } @@ -133,17 +133,17 @@ function __($s) return Lang::instance()->get($s); } -function mttinfo($v) +function mttinfo($v, $escape = true) { global $_mttinfo; - if(!isset($_mttinfo[$v])) { - echo get_mttinfo($v); - } else { - echo $_mttinfo[$v]; - } + echo $escape ? get_mttinfo($v) : get_unsafe_mttinfo($v); } -function get_mttinfo($v) +/* + * Returned values from get_unsafe_mttinfo() can be unsafe for html. + * But '\r' and '\n' in URLs taken from config are removed. + */ +function get_unsafe_mttinfo($v) { global $_mttinfo; if (isset($_mttinfo[$v])) { @@ -152,13 +152,13 @@ function get_mttinfo($v) switch($v) { case 'template_url': - $_mttinfo['template_url'] = get_mttinfo('mtt_url'). 'themes/'. Config::get('template') . '/'; + $_mttinfo['template_url'] = get_unsafe_mttinfo('mtt_url'). 'themes/'. Config::get('template') . '/'; return $_mttinfo['template_url']; case 'includes_url': - $_mttinfo['includes_url'] = get_mttinfo('mtt_url'). 'includes/'; + $_mttinfo['includes_url'] = get_unsafe_mttinfo('mtt_url'). 'includes/'; return $_mttinfo['includes_url']; case 'url': - $_mttinfo['url'] = Config::get('url'); // need to have a trailing slash + $_mttinfo['url'] = Config::getUrl('url'); // need to have a trailing slash if ($_mttinfo['url'] == '') { $proto = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != '' && $_SERVER['HTTPS'] != 'off') ? 'https://' : 'http://'; $defport = ($proto == 'https://') ? 443 : 80; @@ -166,22 +166,22 @@ function get_mttinfo($v) } return $_mttinfo['url']; case 'mobile_url': - $_mttinfo['mobile_url'] = Config::get('mobile_url'); + $_mttinfo['mobile_url'] = Config::getUrl('mobile_url'); if ($_mttinfo['mobile_url'] == '') { - $_mttinfo['mobile_url'] = get_mttinfo('url'). '?mobile'; + $_mttinfo['mobile_url'] = get_unsafe_mttinfo('url'). '?mobile'; } return $_mttinfo['mobile_url']; case 'desktop_url': - $_mttinfo['desktop_url'] = get_mttinfo('url'). '?desktop'; + $_mttinfo['desktop_url'] = get_unsafe_mttinfo('url'). '?desktop'; return $_mttinfo['desktop_url']; case 'mtt_url': - $_mttinfo['mtt_url'] = Config::get('mtt_url'); // need to have a trailing slash + $_mttinfo['mtt_url'] = Config::getUrl('mtt_url'); // need to have a trailing slash if ($_mttinfo['mtt_url'] == '') { $_mttinfo['mtt_url'] = url_dir(getRequestUri()); } return $_mttinfo['mtt_url']; case 'title': - $_mttinfo['title'] = (Config::get('title') != '') ? htmlarray(Config::get('title')) : __('My Tiny Todolist'); + $_mttinfo['title'] = (Config::get('title') != '') ? Config::get('title') : __('My Tiny Todolist'); return $_mttinfo['title']; case 'version': if (MTT_VERSION != '@VERSION') { @@ -192,6 +192,11 @@ function get_mttinfo($v) } } +function get_mttinfo($v) +{ + return htmlspecialchars( get_unsafe_mttinfo($v) ); +} + function getRequestUri() { // Do not use HTTP_X_REWRITE_URL due to CVE-2018-14773 diff --git a/src/settings.php b/src/settings.php index e07f25a..6f1fc68 100644 --- a/src/settings.php +++ b/src/settings.php @@ -25,7 +25,7 @@ if(isset($_POST['save'])) // in Demo mode we can set only language by cookies if(defined('MTTDEMO')) { - setcookie('lang', Config::get('lang'), 0, url_dir(Config::get('url')=='' ? $_SERVER['REQUEST_URI'] : Config::get('url'))); + setcookie('lang', Config::get('lang'), 0, url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'))); $t['saved'] = 1; jsonExit($t); } diff --git a/src/themes/default/index.php b/src/themes/default/index.php index 5286958..9d2513a 100644 --- a/src/themes/default/index.php +++ b/src/themes/default/index.php @@ -26,7 +26,7 @@