Nouvelle fonction plxUtils::sanitizePhp ( voir issue pluxml#558

kazimentou · Nov 28, 2022 · 20fd2c1 · 20fd2c1
1 parent 717ef58
commit 20fd2c1
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 2 deletions.
diff --git a/core/lib/class.plx.admin.php b/core/lib/class.plx.admin.php
@@ -1035,7 +1035,7 @@ public function editStatique($content) {
 			# Génération du nom du fichier de la page statique
 			$filename = PLX_ROOT.$this->aConf['racine_statiques'].$content['id'].'.'.$this->aStats[ $content['id'] ]['url'].'.php';
 			# On écrit le fichier
-			if(plxUtils::write($content['content'],$filename))
+			if(plxUtils::write(plxUtils::sanitizePhp($content['content']),$filename))
 				return plxMsg::Info(L_SAVE_SUCCESSFUL);
 			else
 				return plxMsg::Error(L_SAVE_ERR.' '.$filename);

diff --git a/core/lib/class.plx.utils.php b/core/lib/class.plx.utils.php
@@ -876,7 +876,8 @@ public static function strCheck($str) {
 	 **/
 	public static function cdataCheck($str) {
 		$str = str_ireplace('!CDATA', '&#33;CDATA', $str);
-		return str_replace(']]>', ']]&gt;', $str);
+        $str = str_replace(']]>', ']]&gt;', $str);
+		return self::sanitizePhp($str);
 	}
 
 	/**
@@ -1506,4 +1507,25 @@ public static function printLinkCss($file, $admin=false) {
 		}
 	}
 
+    /**
+     * Remove Php opening and closing tags
+     *
+     * Deprecated !
+     * @param String $content
+     * @return array|string|string[]
+     * @author Pedro "P3ter" CADETE, Moritz Huppert
+     */
+    public static function sanitizePhpTags(String $content) {
+        return str_ireplace(array("<?php","<?", "?>"), "", $content);;
+    }
+
+    /**
+     * Remove critical functions from PHP
+     * @param String $content
+     * @return String
+     * @author Jean-Pierre Pourrez aka bazooka07
+     **/
+    public static function sanitizePhp(String $content) {
+		return preg_replace('#\b(fsockopen|proc_open|system|exec|chroot|shell_exec|socket\w*)\b\([^)]*?\)\s*;#', '/* $1() not allowed here */;' . PHP_EOL, $content);
+	}
 }