Changeset 601

Timestamp:

10/15/06 16:31:18 (2 years ago)

Author:

Rickard

Message:

Fixed a local file inclusion vulnerability. Was fixed into profile.php some time ago, but for some reason, was left out of register.php.

Files:

• trunk/upload/admin_options.php (modified) (1 diff)
• trunk/upload/register.php (modified) (1 diff)

trunk/upload/admin_options.php

@@ -46 +46 @@
-        if ($form['board_title'] == '')
-                message('You must enter a board title.');
+
+        // Clean default_lang
+        $form['default_lang'] = preg_replace('#[\.\\\/]#', '', $form['default_lang']);
-
-        require PUN_ROOT.'include/email.php';

trunk/upload/register.php

@@ -174 +174 @@
-        }
-
+        // Make sure we got a valid language string
+        if (isset($_POST['language']))
+        {
+                $language = preg_replace('#[\.\\\/]#', '', $_POST['language']);
+                if (!file_exists(PUN_ROOT.'lang/'.$language.'/common.php'))
+                                message($lang_common['Bad request']);
+        }
+        else
+                $language = $pun_config['o_default_lang'];
+
-        $timezone = intval($_POST['timezone']);
-        $language = isset($_POST['language']) ? $_POST['language'] : $pun_config['o_default_lang'];
-        $save_pass = (!isset($_POST['save_pass']) || $_POST['save_pass'] != '1') ? '0' : '1';
-