fix(core): better check to include file from path

pluginsGLPI · Jan 25, 2022 · 10ea311 · 10ea311
1 parent a3fc747
commit 10ea311
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 14 deletions.
diff --git a/front/commondropdown.form.php b/front/commondropdown.form.php
@@ -1,11 +1,8 @@
 <?php
 
 include "../../../inc/includes.php";
-$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.form.php';
-$realpath = str_replace( "\\", "/", realpath($path));
-$frontpath = str_replace("\\", "/", realpath(PLUGINFIELDS_FRONT_PATH));
-if (strpos($realpath, $frontpath) === 0) {
-    include_once $path;
-} else {
-    throw new \RuntimeException('Attempt to load unsecure or missing ' . $path .'!');
+if (preg_match('/[a-z]/i', $_REQUEST['ddtype']) !== 1) {
+   throw new \RuntimeException(sprintf('Invalid itemtype "%"', $_REQUEST['ddtype']));
 }
+$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.form.php';
+require_once $path;
diff --git a/front/commondropdown.php b/front/commondropdown.php
@@ -1,11 +1,8 @@
 <?php
 
 include "../../../inc/includes.php";
-$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.php';
-$realpath = str_replace( "\\", "/", realpath($path));
-$frontpath = str_replace("\\", "/", realpath(PLUGINFIELDS_FRONT_PATH));
-if (strpos($realpath, $frontpath) === 0) {
-    include_once $path;
-} else {
-    throw new \RuntimeException('Attempt to load unsecure or missing ' . $path .'!');
+if (preg_match('/[a-z]/i', $_REQUEST['ddtype']) !== 1) {
+   throw new \RuntimeException(sprintf('Invalid itemtype "%"', $_REQUEST['ddtype']));
 }
+$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.php';
+require_once $path;