Changeset 388

Timestamp:

10/22/05 01:39:37 (8 years ago)

Author:

gogo

Message:

Apply #562
Apply some security patches sent in privately by Yermo

Location:

trunk/plugins/SpellChecker

Files:

• aspell_setup.php (modified) (6 diffs)
• spell-check-ui.js (modified) (1 diff)

trunk/plugins/SpellChecker/aspell_setup.php

@@ -1 +1 @@
 <?php
+// REVISION HISTORY:
+//
+// 2005-08-17 YmL:
+//      .       security fix on unchecked variables. Original author missed quite a few
+//              holes.
+
   umask(000);
   $temptext = tempnam('/tmp', 'spell_');
@@ -9 +15 @@
   {
       $lang = $_POST['dictionary'];
-  }
-
+  }  
+  $lang = preg_replace('/[^a-z0-9_]/i', '', $lang);
+  
   $aspell      = 'aspell';
   $aspell_args = '-a --lang=' . $lang;
@@ -35 +42 @@
   preg_match('/really aspell ([0-9]+)\.([0-9]+)(?:\.([0-9]+))?/i', `$aspell version`, $aVer);
 
-  $aVer = array('major' => (int)$aVer[1], 'minor' => (int)$aVer[2], 'release' => (int)$aVer[3]);
+  $aVer = array('major' => (int)$aVer[1], 'minor' => (int)$aVer[2], 'release' => (int)@$aVer[3]);
   if($aVer['major'] >= 0 && $aVer['minor'] >= 60)
   {
@@ -50 +57 @@
 
   // Personal dictionaries
-  if(!isset($_REQUEST['p_dicts_path']))
-  {
-    $_REQUEST['p_dicts_path'] = dirname(__FILE__) . DIRECTORY_SEPARATOR . 'personal_dicts';
-  }
+  $p_dicts_path = dirname(__FILE__) . DIRECTORY_SEPARATOR . 'personal_dicts';
 
   if(file_exists($_REQUEST['p_dicts_path']) && is_writable($_REQUEST['p_dicts_path']))
@@ -68 +72 @@
         setcookie('SpellChecker_p_dicts_name', $_REQUEST['p_dicts_name'], time() + 60*60*24*365*10);
       }
-    }
-    $p_dict_path = $_REQUEST['p_dicts_path'] . DIRECTORY_SEPARATOR . $_REQUEST['p_dicts_name'];
+    }    
+    $p_dict_path = $_REQUEST['p_dicts_path'] . DIRECTORY_SEPARATOR . preg_replace('/[^a-z0-9_]/i', '', $_REQUEST['p_dicts_name']);
 
     if(!file_exists($p_dict_path))
     {
+                // since there is a single directory for all users this could end up containing
+                // quite a few subdirectories. To prevent a DOS situation we'll limit the 
+                // total directories created to 2000 (arbitrary). Adjust to suit your installation.
+
+                $count = 0;
+
+                if( $dir = @opendir( $p_dicts_path ) )
+                        {
+
+                        while( FALSE !== ($file = readdir($dir)) )
+                                {
+                                $count++;
+                                }
+                        }
+
+                // TODO: make this a config value.
+
+                if ( $count > 2000 )
+                        {
+
+                        // either very heavy use or a DOS attempt
+
+                        die();
+
+                        }
+
       mkdir($p_dict_path);
       chmod($p_dict_path, 02770);
@@ -84 +114 @@
   }
 
+// as an additional precaution check the aspell_args for illegal 
+// characters
+  $aspell_args = preg_replace( "/[|><;\$]+/", $aspell_args );
   $aspelldictionaries = "$aspell dump dicts";
   $aspellcommand      = "$aspell $aspell_args < $temptext";

trunk/plugins/SpellChecker/spell-check-ui.js

@@ -239 +239 @@
   else
   {
-    document.getElementById("b_learn").parent.removeChild(document.getElementById("b_learn"));
+    document.getElementById("b_learn").parentNode.removeChild(document.getElementById("b_learn"));
   }
   document.getElementById("b_replall").onclick = replaceAllClicked;