Opened 8 years ago

Closed 7 years ago

Last modified 7 years ago

#14739 closed defect (fixed)

[security] CLI check by $_SERVER[HTTP_HOST]

Reported by: fbest Owned by: bill
Priority: undecided Milestone: 1.8.1
Component: Doc parser Version: 1.7.1
Keywords: Cc:
Blocked By: Blocking:

Description

in website/trunk/api/lib/ transform.php and spider.php is isset($_SERVERHTTP_HOST?) used to determine if CLI is used... This can be tricket by sending an FOOBAR Request which will be interpreted as GET but HTTP_HOST is not set.

my attached patch will fix the problem.

i would also put an htaccess file into lib/ which restricts some using files which aren't public. http://dojotoolkit.org/api/lib/

Attachments (1)

sec.patch (589 bytes) - added by fbest 8 years ago.
patch

Download all attachments as: .zip

Change History (10)

Changed 8 years ago by fbest

Attachment: sec.patch added

patch

comment:1 Changed 8 years ago by fbest

htaccess could look like this?! are other files as them needet by external access?

<Files ~ "(item|class-tree)\.php" >
        order allow,deny
        allow from all
</Files>
order deny,allow
deny from all
allow from 127.0.0.1
Last edited 7 years ago by bill (previous) (diff)

comment:2 Changed 7 years ago by bill

Owner: changed from Neil Roberts to Tom Trenka
Status: newassigned

I'm not sure if this ticket is about the doc viewer (for ttrenka) or a general website issue for iTorrey.

comment:3 Changed 7 years ago by Tom Trenka

Its the doc viewer. I'll take a look.

comment:4 Changed 7 years ago by bill

Milestone: tbd1.8.1
Owner: changed from Tom Trenka to bill

I removed transform.php completely for 1.8 but spider.php is still there.

comment:5 Changed 7 years ago by bill

Resolution: fixed
Status: assignedclosed

OK, I checked in your fix for spider.php.

comment:6 Changed 7 years ago by fbest

same in ./generate.php:17:if (isset($_SERVERHTTP_HOST?)) {

(i cant reopen)

comment:7 Changed 7 years ago by bill

Milestone: 1.8.11.8.2
Resolution: fixed
Status: closedreopened

comment:8 Changed 7 years ago by bill

Milestone: 1.8.21.8.1
Resolution: fixed
Status: reopenedclosed

@fbest: line 17 of lib/generate.php is:

case 'node':

and lib.old/generate.php is:

case 'DOMNode':

I don't see any remaining lines using isset() and $_SERVER[HTTP_HOST].

I can add the .htaccess though.

Note: See TracTickets for help on using tickets.