8000 attempt to fix the Issue: Directory traversal vulnerability (CVE-202… · Jacotheron/laravel-filemanager@3248ab4 · GitHub
[go: up one dir, main page]
Skip to content

Commit 3248ab4

Browse files
JacotheronJacotheron
committed
attempt to fix the Issue: Directory traversal vulnerability (CVE-2022-40734) UniSharp#1150. Fix uses the php realpath function to evaluate the actual file path, and then ensure that the file being requested is below the local disk root
1 parent 9e90227 commit 3248ab4

8 files changed

+80
-1
lines changed

‎src/Controllers/CropController.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace UniSharp\LaravelFilemanager\Controllers;
44

5+
use Illuminate\Support\Str;
56
use Intervention\Image\Facades\Image;
67
use UniSharp\LaravelFilemanager\Events\ImageIsCropping;
78
use UniSharp\LaravelFilemanager\Events\ImageWasCropped;
@@ -29,6 +30,15 @@ public function getCropimage($overWrite = true)
2930
{
3031
$image_name = request('img');
3132
$image_path = $this->lfm->setName($image_name)->path('absolute');
33+
34+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
35+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
36+
$file_real_path = realpath($image_path);
37+
if(!Str::startsWith($file_real_path, $disk_root)){
38+
abort(404);
39+
}
40+
}
41+
3242
$crop_path = $image_path;
3343

3444
if (! $overWrite) {

‎src/Controllers/DeleteController.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace UniSharp\LaravelFilemanager\Controllers;
44

55
use Illuminate\Support\Facades\Storage;
6+
use Illuminate\Support\Str;
67
use UniSharp\LaravelFilemanager\Events\FileIsDeleting;
78
use UniSharp\LaravelFilemanager\Events\FileWasDeleted;
89
use UniSharp\LaravelFilemanager\Events\FolderIsDeleting;
@@ -36,6 +37,14 @@ public function getDelete()
3637
abort(404);
3738
}
3839

40+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
41+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
42+
$file_real_path = realpath($file->path('absolute'));
43+
if(!Str::startsWith($file_real_path, $disk_root)){
44+
abort(404);
45+
}
46+
}
47+
3948
$file_to_delete = $this->lfm->pretty($name_to_delete);
4049
$file_path = $file_to_delete->path('absolute');
4150

‎src/Controllers/DownloadController.php

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace UniSharp\LaravelFilemanager\Controllers;
44

55
use Illuminate\Support\Facades\Storage;
6+
use Illuminate\Support\Str;
67

78
class DownloadController extends LfmController
89
{
@@ -14,6 +15,16 @@ public function getDownload()
1415
abort(404);
1516
}
1617

17-
return response()->download($file->path('absolute'));
18+
$file_absolute = $file->path('absolute');
19+
20+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
21+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
22+
$file_real_path = realpath($file_absolute);
23+
if(!Str::startsWith($file_real_path, $disk_root)){
24+
abort(404);
25+
}
26+
}
27+
28+
return response()->download($file_absolute);
1829
}
1930
}

‎src/Controllers/FolderController.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace UniSharp\LaravelFilemanager\Controllers;
44

5+
use Illuminate\Support\Str;
56
use UniSharp\LaravelFilemanager\Events\FolderIsCreating;
67
use UniSharp\LaravelFilemanager\Events\FolderWasCreated;
78

@@ -44,6 +45,14 @@ public function getAddfolder()
4445

4546
$new_path = $this->lfm->setName($folder_name)->path('absolute');
4647

48+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
49+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
50+
$file_real_path = realpath($new_path);
51+
if(!Str::startsWith($file_real_path, $disk_root)){
52+
abort(404);
53+
}
54+
}
55+
4756
event(new FolderIsCreating($new_path));
4857

4958
try {

‎src/Controllers/ItemsController.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace UniSharp\LaravelFilemanager\Controllers;
44

55
use Illuminate\Support\Facades\Storage;
6+
use Illuminate\Support\Str;
67
use UniSharp\LaravelFilemanager\Events\FileIsMoving;
78
use UniSharp\LaravelFilemanager\Events\FileWasMoving;
89
use UniSharp\LaravelFilemanager\Events\FolderIsMoving;
@@ -73,6 +74,14 @@ public function domove()
7374
abort(404);
7475
}
7576

77+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
78+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
79+
$file_real_path = realpath($file->path('absolute'));
80+
if(!Str::startsWith($file_real_path, $disk_root)){
81+
abort(404);
82+
}
83+
}
84+
7685
$old_path = $old_file->path();
7786

7887
if ($old_file->hasThumb()) {

‎src/Controllers/RedirectController.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace UniSharp\LaravelFilemanager\Controllers;
44

55
use Illuminate\Support\Facades\Storage;
6+
use Illuminate\Support\Str;
67

78
class RedirectController extends LfmController
89
{
@@ -14,6 +15,16 @@ public function showFile($file_path)
1415
abort(404);
1516
}
1617

18+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
19+
$file = $this->lfm->setName($file_path);
20+
$file_absolute = $file->path('absolute');
21+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
22+
$file_real_path = realpath($file_absolute);
23+
if(!Str::startsWith($file_real_path, $disk_root)){
24+
abort(404);
25+
}
26+
}
27+
1728
return response($storage->get($file_path))
1829
->header('Content-Type', $storage->mimeType($file_path));
1930
}

‎src/Controllers/RenameController.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace UniSharp\LaravelFilemanager\Controllers;
44

55
use Illuminate\Support\Facades\Storage;
6+
use Illuminate\Support\Str;
67
use UniSharp\LaravelFilemanager\Events\FolderIsRenaming;
78
use UniSharp\LaravelFilemanager\Events\FolderWasRenamed;
89
use UniSharp\LaravelFilemanager\Events\FileIsRenaming;
@@ -23,6 +24,16 @@ public function getRename()
2324
abort(404);
2425
}
2526

27+
$file_absolute = $file->path('absolute');
28+
29+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
30+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
31+
$file_real_path = realpath($file_absolute);
32+
if(!Str::startsWith($file_real_path, $disk_root)){
33+
abort(404);
34+
}
35+
}
36+
2637
$old_file = $this->lfm->pretty($old_name);
2738

2839
$is_directory = $file->isDirectory();

‎src/Controllers/ResizeController.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace UniSharp\LaravelFilemanager\Controllers;
44

5+
use Illuminate\Support\Str;
56
use Intervention\Image\Facades\Image;
67
use UniSharp\LaravelFilemanager\Events\ImageIsResizing;
78
use UniSharp\LaravelFilemanager\Even 9477 ts\ImageWasResized;
@@ -56,6 +57,14 @@ public function performResize()
5657
{
5758
$image_path = $this->lfm->setName(request('img'))->path('absolute');
5859

60+
if(config('filesystems.disks.'.$this->helper->config('disk').'.driver') === 'local'){
61+
$disk_root = realpath(config('filesystems.disks.'.$this->helper->config('disk').'.root'));
62+
$file_real_path = realpath($image_path);
63+
if(!Str::startsWith($file_real_path, $disk_root)){
64+
abort(404);
65+
}
66+
}
67+
5968
event(new ImageIsResizing($image_path));
6069
Image::make($image_path)->resize(request('dataWidth'), request('dataHeight'))->save();
6170
event(new ImageWasResized($image_path));

0 commit comments

Comments
 (0)
0