Changeset 1250

Timestamp:

05/03/10 13:08:46 (3 years ago)

Author:

gogo

Message:

ticket:1515 Security patch to prevent rogue access to the compressors in contrib.

Location:

trunk/contrib

Files:

• .htaccess (added)
• compress.php (modified) (1 diff)
• compress_yui.php (modified) (1 diff)

trunk/contrib/compress.php

@@ -85 +85 @@
         
         exec("echo \"".(preg_match('/XinhaCore.js$/',$file) ? $file_prefix.$core_prefix : $file_prefix)."\" > $file && java -jar ${cwd}/dojo_js_compressor.jar -c ${file}_uncompr.js >> $file 2>&1");
-        if (preg_match('/js: ".*?", line \d+:/',file_get_contents($file)))
+        if (preg_match('/js: ".*?", line \d+:/',file_get_contents($file)) || preg_match('/sh: java: command not found/', file_get_contents($file)))
         {
                 unlink($file);

trunk/contrib/compress_yui.php

@@ -93 +93 @@
 
         passthru("echo \"".(preg_match('/XinhaCore.js$/',$file) ? $file_prefix.$core_prefix : $prefix)."\" > $file && java -jar {$xinha_root}/contrib/yuicompressor-2.4.2.jar  --charset UTF-8 ${file}_uncompr${ext} >> $file 2>&1");
-        if (preg_match('/\d+:\d+:syntax error/',file_get_contents($file)))
+        if (preg_match('/\d+:\d+:syntax error/',file_get_contents($file)) || preg_match('/sh: java: command not found/', file_get_contents($file)))
         {
                 unlink($file);