From f343e169a2afda4512cf64d98b074ded71fbe532 Mon Sep 17 00:00:00 2001 From: Marius Burkard Date: Tue, 23 Jul 2019 19:32:22 +0200 Subject: [PATCH] Insufficient escaping of whitespace in FTP user paths, fixes #5350 --- interface/web/sites/form/ftp_user.tform.php | 5 ++++- server/plugins-available/ftpuser_base_plugin.inc.php | 6 ++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/interface/web/sites/form/ftp_user.tform.php b/interface/web/sites/form/ftp_user.tform.php index 239bfdb858..5e77de4b5f 100644 --- a/interface/web/sites/form/ftp_user.tform.php +++ b/interface/web/sites/form/ftp_user.tform.php @@ -276,7 +276,10 @@ if($app->auth->is_admin()) { 'formtype' => 'TEXT', 'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY', 'errmsg'=> 'directory_error_empty'), - 1 => array ( 'type' => 'CUSTOM', + 1 => array ( 'type' => 'REGEX', + 'regex' => '/^\/[a-zA-Z0-9\ \.\-\_\/]{10,128}$/', + 'errmsg'=> 'directory_error_regex'), + 2 => array ( 'type' => 'CUSTOM', 'class' => 'validate_ftpuser', 'function' => 'ftp_dir', 'errmsg' => 'directory_error_notinweb'), diff --git a/server/plugins-available/ftpuser_base_plugin.inc.php b/server/plugins-available/ftpuser_base_plugin.inc.php index af5870a4ba..c34371a181 100644 --- a/server/plugins-available/ftpuser_base_plugin.inc.php +++ b/server/plugins-available/ftpuser_base_plugin.inc.php @@ -83,8 +83,7 @@ class ftpuser_base_plugin { } $app->system->web_folder_protection($web['document_root'], false); - exec('mkdir -p '.escapeshellcmd($data['new']['dir'])); - exec('chown '.escapeshellcmd($web["system_user"]).':'.escapeshellcmd($web['system_group']).' '.$data['new']['dir']); + $app->system->mkdirpath($data['new']['dir'], 0755, $web["system_user"], $web["system_group"]); $app->system->web_folder_protection($web['document_root'], true); $app->log("Added ftpuser_dir: ".$data['new']['dir'], LOGLEVEL_DEBUG); @@ -109,8 +108,7 @@ class ftpuser_base_plugin { } $app->system->web_folder_protection($web['document_root'], false); - exec('mkdir -p '.escapeshellcmd($data['new']['dir'])); - exec('chown '.escapeshellcmd($web["system_user"]).':'.escapeshellcmd($web['system_group']).' '.$data['new']['dir']); + $app->system->mkdirpath($data['new']['dir'], 0755, $web["system_user"], $web["system_group"]); $app->system->web_folder_protection($web['document_root'], true); -- GitLab