From 89c6d3d42986ec526885efc911f678fd42b1dbb2 Mon Sep 17 00:00:00 2001
From: Stanislas KITA <skita@teclib.com>
Date: Fri, 14 Jan 2022 09:34:58 +0100
Subject: [PATCH] fix(core): better check to include file from path

---
 front/commondropdown.form.php | 11 ++++-------
 front/commondropdown.php      | 11 ++++-------
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/front/commondropdown.form.php b/front/commondropdown.form.php
index 52a827ef..138a9c76 100644
--- a/front/commondropdown.form.php
+++ b/front/commondropdown.form.php
@@ -1,11 +1,8 @@
 <?php
 
 include "../../../inc/includes.php";
-$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.form.php';
-$realpath = str_replace( "\\", "/", realpath($path));
-$frontpath = str_replace("\\", "/", realpath(PLUGINFIELDS_FRONT_PATH));
-if (strpos($realpath, $frontpath) === 0) {
-    include_once $path;
-} else {
-    throw new \RuntimeException('Attempt to load unsecure or missing ' . $path .'!');
+if (preg_match('/[a-z]/i', $_REQUEST['ddtype']) !== 1) {
+   throw new \RuntimeException(sprintf('Invalid itemtype "%"', $_REQUEST['ddtype']));
 }
+$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.form.php';
+require_once $path;
diff --git a/front/commondropdown.php b/front/commondropdown.php
index 713a5734..04a60d80 100644
--- a/front/commondropdown.php
+++ b/front/commondropdown.php
@@ -1,11 +1,8 @@
 <?php
 
 include "../../../inc/includes.php";
-$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.php';
-$realpath = str_replace( "\\", "/", realpath($path));
-$frontpath = str_replace("\\", "/", realpath(PLUGINFIELDS_FRONT_PATH));
-if (strpos($realpath, $frontpath) === 0) {
-    include_once $path;
-} else {
-    throw new \RuntimeException('Attempt to load unsecure or missing ' . $path .'!');
+if (preg_match('/[a-z]/i', $_REQUEST['ddtype']) !== 1) {
+   throw new \RuntimeException(sprintf('Invalid itemtype "%"', $_REQUEST['ddtype']));
 }
+$path = PLUGINFIELDS_FRONT_PATH . '/' . $_REQUEST['ddtype'] . '.php';
+require_once $path;