adulau/cakephp2-php8
1
0
Fork 0
mirror of https://github.com/kamilwylegala/cakephp2-php8.git synced 2024-11-15 03:18:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #9807 from cakephp/2.x-pages-controller

Browse source 
Fix directory traversal of .ctp files
This commit is contained in:
Mark Story 2016-11-27 21:11:17 -05:00 committed by GitHub
commit 1152cbcd2d
3 changed files with 26 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/Controller/PagesController.php
View file

@ -41,6 +41,7 @@ class PagesController extends AppController {
* Displays a view
*
* @return void
* @throws ForbiddenException When a directory traversal attempt.
* @throws NotFoundException When the view file could not be found
* or MissingViewException in debug mode.
*/
@ -51,6 +52,9 @@ class PagesController extends AppController {
if (!$count) {
return $this->redirect('/');
}
if (in_array('..', $path, true) || in_array('.', $path, true)) {
throw new ForbiddenException();
}
$page = $subpage = $title_for_layout = null;
if (!empty($path[0])) {

4
lib/Cake/Console/Templates/skel/Controller/PagesController.php
View file

@ -32,6 +32,7 @@ class PagesController extends AppController {
* Displays a view
*
* @return void
* @throws ForbiddenException When a directory traversal attempt.
* @throws NotFoundException When the view file could not be found
* or MissingViewException in debug mode.
*/
@ -42,6 +43,9 @@ class PagesController extends AppController {
if (!$count) {
return $this->redirect('/');
}
if (in_array('..', $path, true) || in_array('.', $path, true)) {
throw new ForbiddenException();
}
$page = $subpage = $title_for_layout = null;
if (!empty($path[0])) {

17
lib/Cake/Test/Case/Controller/PagesControllerTest.php
View file

@ -75,4 +75,21 @@ class PagesControllerTest extends CakeTestCase {
$Pages = new PagesController(new CakeRequest(null, false), new CakeResponse());
$Pages->display('non_existing_page');
}
/**
* Test directory traversal protection
*
* @expectedException ForbiddenException
* @expectedExceptionCode 403
* @return void
*/
public function testDirectoryTraversalProtection() {
App::build(array(
'View' => array(
CAKE . 'Test' . DS . 'test_app' . DS . 'View' . DS
)
));
$Pages = new PagesController(new CakeRequest(null, false), new CakeResponse());
$Pages->display('..', 'Posts', 'index');
}
}