jenkins-bot has submitted this change and it was merged. ( https://gerrit.wikimedia.org/r/342330 )
Change subject: SECURITY: Avoid path traversal, follow best practises for escaping ...................................................................... SECURITY: Avoid path traversal, follow best practises for escaping Want to ensure that things in repo follow good security practises in case people copy them. See also T787. This also makes the extension work again on latest master. Change-Id: Ic36102b93adb3b0b1dd2d4145a94a9380b621689 --- M Download.php M DownloadCounter.php 2 files changed, 12 insertions(+), 3 deletions(-) Approvals: Brian Wolff: Looks good to me, approved jenkins-bot: Verified diff --git a/Download.php b/Download.php index d548526..249900a 100644 --- a/Download.php +++ b/Download.php @@ -19,7 +19,7 @@ // Code originally based on http://www.php-astux.info/script-compteur-telechargements.php -require_once( __DIR__ . '/../../includes/AutoLoader.php' ); +putenv( 'MW_INSTALL_PATH=' . __DIR__ . "/../../" ); require_once( __DIR__ . '/../../includes/WebStart.php' ); $filesdir = 'Download/'; // // Path where the files to download are stored @@ -29,7 +29,14 @@ if ( $filename != '' ) { // It is not empty, okay. // WARNING : Check if the file exist + if ( strcspn( $filename, ":/\\\000\n\r" ) !== strlen( $filename ) ) { + header("HTTP/1.1 400 Evil Character"); + echo "File name cannot contain special characters like colons or slashes."; + exit(); + } if ( !file_exists( $filesdir . $filename ) || !is_file( $filesdir . $filename ) ) { + header("HTTP/1.0 404 Not Found"); + echo "File not found"; exit(); } @@ -48,4 +55,6 @@ // Query finish, send the file to the user header( "Location: " . $filesdir . $filename ); exit(); +} else { + header("HTTP/1.1 400 Bad Request"); } diff --git a/DownloadCounter.php b/DownloadCounter.php index fa4c07c..1cf60f3 100644 --- a/DownloadCounter.php +++ b/DownloadCounter.php @@ -26,7 +26,7 @@ $wgExtensionCredits['parserhook'][] = array( 'path' => __FILE__, 'name' => 'DownloadCounter', - 'version' => '0.3.0', + 'version' => '0.4.0', 'author' => 'Eric Petit', 'descriptionmsg' => 'downloadcounter-desc', 'url' => 'https://www.mediawiki.org/wiki/Extension:DownloadCounter', @@ -61,7 +61,7 @@ if ( $db->numRows( $res ) !== 1 ) { // File not found return 0; } else { // File found - return ( $details_type == 'total' ) ? $res->downloaded : date( "d/m/Y H:i:s", $res->last_download ); + return ( $details_type == 'total' ) ? htmlspecialchars( $res->downloaded ) : htmlspecialchars( date( "d/m/Y H:i:s", $res->last_download ) ); } } -- To view, visit https://gerrit.wikimedia.org/r/342330 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ic36102b93adb3b0b1dd2d4145a94a9380b621689 Gerrit-PatchSet: 1 Gerrit-Project: mediawiki/extensions/DownloadCounter Gerrit-Branch: master Gerrit-Owner: Brian Wolff <[email protected]> Gerrit-Reviewer: Brian Wolff <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
