mirror/provision_sccp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add isValidRequest() function

Browse Source 
Signed-off-by: Diederik de Groot <ddegroot@talon.nl>
This commit is contained in:
Diederik de Groot
2020-02-15 23:42:46 +01:00
parent b8903f761a
commit fcf0495a38
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/resolver.php
View File

@@ -8,6 +8,7 @@ include_once("config.php");
- improve error handling - improve error handling
- secure urlencoding/urldecoding - secure urlencoding/urldecoding
- don't allow browsing - don't allow browsing
- See isValidRequest()
- check source ip-range - check source ip-range
- check HTTPHeader for known BrowserTypes - check HTTPHeader for known BrowserTypes
*/ */
@@ -76,7 +77,16 @@ class Resolver {
unset($this->cache[$hash]); unset($this->cache[$hash]);
$this->isDirty = TRUE; $this->isDirty = TRUE;
} }
function isValidRequest($request) {
/* todo: make sure request does not startwith or contain: "/", "../" or "/./" */
/* todo: make sure request only starts with filename or one of $config[$subdir]['locale'] or $config[$subdir]['wallpaper'] */
/* todo: check uri/url decode */
return TRUE;
}
function resolve($request) /* canthrow */ { function resolve($request) /* canthrow */ {
if (!$this->isValidRequest($request)) {
throw new Exception("Invalid request:'$request'");
}
$path = ''; $path = '';
if (array_key_exists($request, $this->cache)) { if (array_key_exists($request, $this->cache)) {
if ($path = $this->cache[$request]) { if ($path = $this->cache[$request]) {