Can not open files outside the root directory

[mschwed]

Hi all,
I am using ICEcoder since a year and it is a great peace of code, thank you very much.
I just installed the new version (V4.5) and now, I can not open existing files outsite the root directory (even not with mode 777). The directory tree is shown without problems, including the sym link inside the root directory poining outside.

Thank you for your help
Michael

[mattpass]

I would suggest:

1 - F12 to open dev tools, switch to the Console tab and CTRL+F5 to hard reload. Try again and if errors occur let me know.
2 - Uncomment line 52 of lib/file-control.php and try again. It will alert and console log the action and path it's attempting - do these seem right?
3 - If you've upgraded recently a fresh install from this repo may help.

[mattpass]

Going to close this as trying to clear bugs prior to v5 launch. Please reopen if you still have the problem.

[loclamor]

Hi, I have installed ICEcoder yesterday (last version from master), and i have the same problem as above :
I cannot open files out of the root directory.
My other files are in sym link directories.
I have files in 755 and 777 chmod and i cannot open.

I have no javascript errors in console, and I've tried to uncomment the line in lib/file-control.php and it log "load" action and corrects paths every time :
for instance : "load : /var/www/test/index.html"
this path exists (via a sym link to test) and the realpath is /home/loclamor/test/index.html

Thanks for your help, i would be really happy to use ICEcoder !

[mattpass]

Reopening as I can also see this issue. Not sure what can be done about the problem but will look into it.

[andrey012]

Matt, I personally have tweaked this in my installation, because I also needed to make it follow symlinked directories.
I have tracked place where this security decision is made - probably it will be helpful (see diffs below).
I think, that:

1. realpath verification (that I've removed in the patches below) - is indeed useful and should be in place to prevent symlink attacks.
2. I think it is reasonable to let user specify in the config file set of realpaths, access to which is allowed. At the moment the only such realpath is root folder.

diff --git a/lib/file-control-xhr.php b/lib/file-control-xhr.php
index 56cff8e..3065321 100644
--- a/lib/file-control-xhr.php
+++ b/lib/file-control-xhr.php
@@ -62,7 +62,7 @@ for ($i=0; $i<count($allFiles); $i++) {
// A local folder that isn't the doc root or starts with the doc root
($_GET['action']!="getRemoteFile" &&
rtrim($allFiles[$i],"/") !== rtrim($docRoot,"/") &&

• strpos(realpath(rtrim(dirname($allFiles[$i]),"/")),realpath(rtrim($docRoot,"/"))) !== 0

•                   0
           ) ||
  

diff --git a/lib/file-control.php b/lib/file-control.php
index 0e07ba9..a81f352 100644
--- a/lib/file-control.php
+++ b/lib/file-control.php
@@ -56,7 +56,7 @@ for ($i=0; $i<count($allFiles); $i++) {
// A local folder that isn't the doc root or starts with the doc root
($_GET['action']!="getRemoteFile" &&
rtrim($allFiles[$i],"/") !== rtrim($docRoot,"/") &&

• strpos(realpath(rtrim(dirname($allFiles[$i]),"/")),realpath(rtrim($docRoot,"/"))) !== 0

•                   0
           ) ||
  

AG
Matt Pass wrote:

Reopening as I can also see this issue. Not sure what can be done about the problem but will look into it.

—
Reply to this email directly or view it on GitHub #526 (comment).

[mattpass]

Hi @andrey012 - thanks for pointing this out and the solution also. Yes, I'd put those checks in to avoid symlink attacks and also dir traversal attacks. It's necessary code to help keep systems safe but there are legitimate cases as we're all finding.

Not sure I want to specify a realpath for every possible dir tho. (A site I'm working on right now has 100+ symlinks to different dirs and it'd be a pain to set up & maintain).

Am wondering if a 'Allow Symlinks' (true/false) checkbox would be a good idea. Turned off by default, you could turn this on in the Settings screen. Should add warning info for users re being more vulnerable and also helpful info on why a symlink file won't open in the first place if turned off?

[andrey012]

Well, as for me - with this "allow symlinks" turned on - system will become unsecure, so this is not a good choice.
I'd still prefer list of allowed locations (e.g. like Apache httpd does with its statement). If you have multiple locations, which are under one and the same root directory - you can simply add this one root directory to the list of allowed locations.

AG

Matt Pass wrote:

Hi @andrey012 https://github.com/andrey012 - thanks for pointing this out and the solution also. Yes, I'd put those checks in to avoid symlink attacks and also dir traversal attacks. It's necessary code to help keep systems safe but there are legitimate cases as we're all finding.

Not sure I want to specify a realpath for every possible dir tho. (A site I'm working on right now has 100+ symlinks to different dirs and it'd be a pain to set up & maintain).

Am wondering if a 'Allow Symlinks' (true/false) checkbox would be a good idea. Turned off by default, you could turn this on in the Settings screen. Should add warning info for users re being more vulnerable and also helpful info on why a symlink file won't open in the first place if turned off?

—
Reply to this email directly or view it on GitHub #526 (comment).

[mattpass]

Your suggestion is the safest for sure. Whatever we do it needs to be hassle free for users to manage.

Security should always override manageability so will probably end up with something like your idea anyway.

[MECU]

I simply changed the "docRoot" setting in lib/settings___config.php to the directory I wanted, which was out of scope of the ICEcoder folder, which got me 90% of what I needed.

/home/me/public/ICEcoder
docRoot => "/home/me"

Setting to '/' would allow access to everything, but is a _slight_ security risk.