Invalid token';
+ }
} elseif (get_by_key($_POST, 'mode') == 'save') {
- echo textsave();
+ if ($token_check) {
+ echo textsave();
+ } else {
+ echo '
Invalid token';
+ }
} elseif (get_by_key($_REQUEST, 'mode') == 'delete') {
- echo delete_file();
+ if ($token_check) {
+ echo delete_file();
+ } else {
+ echo '
Invalid token';
+ }
}
-
if (in_array($startpath, $protected_path)) {
evo()->webAlertAndQuit($_lang["files.dynamic.php2"]);
}
-
$tpl = '
[+subject+]';
$ph = [];
$ph['style_path'] = $theme_image_path;
@@ -253,16 +234,13 @@ function renameFile(file) {
$ph['subject'] = '
Top';
} else {
$ph['image'] = '' . $_style['icon_folder_open'] . '';
- $ph['subject'] = '
Top/';
+ $ph['subject'] = '
Top/';
}
-
echo parsePlaceholder($tpl, $ph);
-
- $len = strlen($filemanager_path);
- if (substr($startpath, $len, strlen($startpath)) == '') {
+ $topic_path = $relative_path;
+ if ($topic_path == '') {
$topic_path = '/';
} else {
- $topic_path = substr($startpath, $len, strlen($startpath));
$pieces = explode('/', rtrim($topic_path, '/'));
$path = '';
$count = count($pieces);
@@ -270,9 +248,9 @@ function renameFile(file) {
if (empty($v)) {
continue;
}
- $path .= rtrim($v, '/') . '/';
+ $path .= $v . '/';
if (1 < $count) {
- $href = 'index.php?a=31&mode=drill&path=' . urlencode($filemanager_path . $path);
+ $href = 'index.php?a=31&mode=drill&path=' . urlencode(rtrim($path, '/'));
$pieces[$i] = '
' . trim($v, '/') . '';
} else {
$pieces[$i] = '
' . trim($v, '/') . '';
@@ -281,134 +259,205 @@ function renameFile(file) {
}
$topic_path = implode('/', $pieces);
}
-
- echo $topic_path; ?>
+ echo $topic_path;
+ ?>
- webAlertAndQuit($_lang["files_access_denied"]);
+ open($file) !== true) {
+ return false;
+ }
+ for ($i = 0; $i < $zip->numFiles; $i++) {
+ $stat = $zip->statIndex($i);
+ $filename = str_replace('\\', '/', $stat['name']);
+ if (substr($filename, 0, 1) == '/' || strpos($filename, '..') !== false || strpos($filename, ':') !== false) {
+ continue; // skip malicious paths
+ }
+ $target = $path . '/' . $filename;
+ $target_real = rtrim(str_replace('\\', '/', realpath(dirname($target)) ?: dirname($target)), '/\\');
+ if (strpos($target_real, $path) !== 0) {
+ continue;
+ }
+ if (substr($filename, -1) == '/') {
+ if (!is_dir($target)) {
+ mkdir($target, 0777, true);
+ }
+ } else {
+ $dirname = dirname($target);
+ if (!is_dir($dirname)) {
+ mkdir($dirname, 0777, true);
+ }
+ file_put_contents($target, $zip->getFromIndex($i));
+ }
+ }
+ $zip->close();
+ return true;
}
- // Unzip .zip files - by Raymond
+ // Unzip .zip files - by Raymond, with safe_unzip
if ($enablefileunzip && get_by_key($_REQUEST, 'mode') == 'unzip' && is_writable($startpath)) {
- if (!$err = unzip(realpath("{$startpath}/" . $_REQUEST['file']), realpath($startpath))) {
- echo '
' . $_lang['file_unzip_fail'] . ($err === 0 ? 'Missing zip library (php_zip.dll / zip.so)' : '') . '';
+ if ($token_check) {
+ $zipfile = str_replace('\\', '/', realpath($startpath . '/' . $_REQUEST['file']));
+ if (strpos($zipfile, $filemanager_path) !== 0) {
+ echo '
Invalid path.';
+ } else {
+ $success = safe_unzip($zipfile, $startpath);
+ if (!$success) {
+ echo '
' . $_lang['file_unzip_fail'] . '';
+ } else {
+ echo '
' . $_lang['file_unzip'] . '';
+ }
+ }
} else {
- echo '
' . $_lang['file_unzip'] . '';
+ echo '
Invalid token';
}
}
// End Unzip - Raymond
-
// New Folder & Delete Folder option - Raymond
if (is_writable($startpath)) {
// Delete Folder
if (get_by_key($_REQUEST, 'mode') == 'deletefolder') {
- $folder = $_REQUEST['folderpath'];
- if (!$token_check || !@rrmdir($folder)) {
- echo '
' . $_lang['file_folder_not_deleted'] . '';
+ if ($token_check) {
+ $requested_folderpath = ltrim($_REQUEST['folderpath'] ?? '', '/');
+ $folder = str_replace('\\', '/', realpath($filemanager_path . '/' . $requested_folderpath));
+ if (strpos($folder, $filemanager_path) !== 0 || !is_dir($folder)) {
+ echo '
Invalid path.';
+ } elseif (!@rrmdir($folder)) {
+ echo '
' . $_lang['file_folder_not_deleted'] . '';
+ } else {
+ echo '
' . $_lang['file_folder_deleted'] . '';
+ }
} else {
- echo '
' . $_lang['file_folder_deleted'] . '';
+ echo '
Invalid token';
}
}
-
// Create folder here
if (get_by_key($_REQUEST, 'mode') == 'newfolder') {
- $old_umask = umask(0);
- $foldername = str_replace('..\\', '', str_replace('../', '', $_REQUEST['name']));
- if (!mkdirs("{$startpath}/{$foldername}", 0777)) {
- echo '
', $_lang['file_folder_not_created'], '';
- } else {
- if (!@chmod($startpath . '/' . $foldername, $newfolderaccessmode)) {
- echo '
' . $_lang['file_folder_chmod_error'] . '';
+ if ($token_check) {
+ $old_umask = umask(0);
+ $foldername = str_replace([ '..\\', '../', '\\', '/' ], '', $_REQUEST['name']);
+ $newdir = $startpath . '/' . $foldername;
+ if (!mkdirs($newdir, 0777)) {
+ echo '
', $_lang['file_folder_not_created'], '';
} else {
- echo '
' . $_lang['file_folder_created'] . '';
+ if (!@chmod($newdir, $newfolderaccessmode)) {
+ echo '
' . $_lang['file_folder_chmod_error'] . '';
+ } else {
+ echo '
' . $_lang['file_folder_created'] . '';
+ }
}
+ umask($old_umask);
+ } else {
+ echo '
Invalid token';
}
- umask($old_umask);
}
// Create file here
if (get_by_key($_REQUEST, 'mode') == 'newfile') {
- $old_umask = umask(0);
- $filename = str_replace('..\\', '', str_replace('../', '', $_REQUEST['name']));
-
- if (!checkExtension($filename)) {
- echo '
' . $_lang['files_filetype_notok'] . '';
- } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $filename) !== 0) {
- echo $_lang['files.dynamic.php3'];
- } else {
- $rs = file_put_contents("{$startpath}/{$filename}", '');
- if ($rs === false) {
- echo '
', $_lang['file_folder_not_created'], '';
+ if ($token_check) {
+ $old_umask = umask(0);
+ $filename = str_replace([ '..\\', '../', '\\', '/' ], '', $_REQUEST['name']);
+ if (!checkExtension($filename)) {
+ echo '
' . $_lang['files_filetype_notok'] . '';
+ } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $filename) !== 0) {
+ echo $_lang['files.dynamic.php3'];
} else {
- echo $_lang['files.dynamic.php4'];
+ $rs = file_put_contents($startpath . '/' . $filename, '');
+ if ($rs === false) {
+ echo '
', $_lang['file_folder_not_created'], '';
+ } else {
+ echo $_lang['files.dynamic.php4'];
+ }
+ umask($old_umask);
}
- umask($old_umask);
+ } else {
+ echo '
Invalid token';
}
}
// Duplicate file here
if (get_by_key($_REQUEST, 'mode') == 'duplicate') {
- $old_umask = umask(0);
- $filename = $_REQUEST['path'];
- $newFilename = str_replace('..\\', '', str_replace('../', '', $_REQUEST['newFilename']));
-
- if (!checkExtension($newFilename)) {
- echo '
' . $_lang['files_filetype_notok'] . '';
- } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newFilename) !== 0) {
- echo $_lang['files.dynamic.php3'];
- } else {
- if (!copy($filename, MODX_BASE_PATH . $newFilename)) {
- echo $_lang['files.dynamic.php5'];
+ if ($token_check) {
+ $old_umask = umask(0);
+ $requested_file = ltrim($_REQUEST['path'] ?? '', '/');
+ $filename = str_replace('\\', '/', realpath($filemanager_path . '/' . $requested_file));
+ if (strpos($filename, $filemanager_path) !== 0 || !is_file($filename)) {
+ echo '
Invalid path.';
+ } else {
+ $newFilename = str_replace([ '..\\', '../', '\\', '/' ], '', $_REQUEST['newFilename']);
+ if (!checkExtension($newFilename)) {
+ echo '
' . $_lang['files_filetype_notok'] . '';
+ } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newFilename) !== 0) {
+ echo $_lang['files.dynamic.php3'];
+ } else {
+ // Fix: Copy to same directory, not base path
+ $newpath = dirname($filename) . '/' . $newFilename;
+ if (!copy($filename, $newpath)) {
+ echo $_lang['files.dynamic.php5'];
+ }
+ umask($old_umask);
+ }
}
- umask($old_umask);
+ } else {
+ echo '
Invalid token';
}
}
// Rename folder here
if (get_by_key($_REQUEST, 'mode') == 'renameFolder') {
- $old_umask = umask(0);
- $dirname = $_REQUEST['path'] . '/' . $_REQUEST['dirname'];
- $newDirname = str_replace([
- '..\\',
- '../',
- '\\',
- '/'
- ], '', $_REQUEST['newDirname']);
-
- if (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newDirname) !== 0) {
- echo $_lang['files.dynamic.php3'];
- } else if (!rename($dirname, $_REQUEST['path'] . '/' . $newDirname)) {
- echo '
', $_lang['file_folder_not_created'], '';
+ if ($token_check) {
+ $old_umask = umask(0);
+ $requested_dir = ltrim($_REQUEST['path'] ?? '', '/');
+ $dirname = str_replace('\\', '/', realpath($filemanager_path . '/' . $requested_dir . '/' . $_REQUEST['dirname']));
+ if (strpos($dirname, $filemanager_path) !== 0 || !is_dir($dirname)) {
+ echo '
Invalid path.';
+ } else {
+ $newDirname = str_replace([ '..\\', '../', '\\', '/' ], '', $_REQUEST['newDirname']);
+ if (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newDirname) !== 0) {
+ echo $_lang['files.dynamic.php3'];
+ } else if (!rename($dirname, dirname($dirname) . '/' . $newDirname)) {
+ echo '
', $_lang['file_folder_not_created'], '';
+ }
+ umask($old_umask);
+ }
+ } else {
+ echo '
Invalid token';
}
- umask($old_umask);
}
// Rename file here
if (get_by_key($_REQUEST, 'mode') == 'renameFile') {
- $old_umask = umask(0);
- $path = dirname($_REQUEST['path']);
- $filename = $_REQUEST['path'];
- $newFilename = str_replace([
- '..\\',
- '../',
- '\\',
- '/'
- ], '', $_REQUEST['newFilename']);
-
- if (!checkExtension($newFilename)) {
- echo '
' . $_lang['files_filetype_notok'] . '';
- } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newFilename) !== 0) {
- echo $_lang['files.dynamic.php3'];
- } else {
- if (!rename($filename, $path . '/' . $newFilename)) {
- echo $_lang['files.dynamic.php5'];
+ if ($token_check) {
+ $old_umask = umask(0);
+ $requested_file = ltrim($_REQUEST['path'] ?? '', '/');
+ $filename = str_replace('\\', '/', realpath($filemanager_path . '/' . $requested_file));
+ if (strpos($filename, $filemanager_path) !== 0 || !is_file($filename)) {
+ echo '
Invalid path.';
+ } else {
+ $path = dirname($filename);
+ $newFilename = str_replace([ '..\\', '../', '\\', '/' ], '', $_REQUEST['newFilename']);
+ if (!checkExtension($newFilename)) {
+ echo '
' . $_lang['files_filetype_notok'] . '';
+ } elseif (preg_match('@(\\\\|\/|\:|\;|\,|\*|\?|\"|\<|\>|\||\?)@', $newFilename) !== 0) {
+ echo $_lang['files.dynamic.php3'];
+ } else {
+ if (!rename($filename, $path . '/' . $newFilename)) {
+ echo $_lang['files.dynamic.php5'];
+ }
+ umask($old_umask);
+ }
}
- umask($old_umask);
+ } else {
+ echo '
Invalid token';
}
}
- }
- // End New Folder - Raymond
-
+ } // End New Folder - Raymond
if (strlen(MODX_BASE_PATH) < strlen($filemanager_path)) {
$len--;
- } ?>
+ }
+ ?>
@@ -420,63 +469,49 @@ function renameFile(file) {
|
- ' . $_lang['files_directory_is_empty'] . ' | ';
- }
+ if ($folders == 0 && $files == 0) { echo '| ' . $_lang['files_directory_is_empty'] . ' |
'; }
?>
-
- ' . $folders . ' ';
+ ' . $folders . ' ';
echo $_lang['files_files'] . ': ' . $files . ' ';
echo $_lang['files_data'] . ': ' . niceSize($filesizes) . ' ';
- echo $_lang['files_dirwritable'] . ' ' . (is_writable($startpath) == 1 ? $_lang['yes'] . '.' : $_lang['no']) . '.'
+ echo $_lang['files_dirwritable'] . ' ' . (is_writable($startpath) == 1 ? $_lang['yes'] : $_lang['no']) . '.'
?>
-
-
-
+
- " . $_lang['files_upload_inhibited_msg'] . "";
- }
- ?>
+ } ?>
-
-
-
+