Prepare 3.4.6 Release

administrator/components/com_templates/controllers/template.php

@@ -376,6 +376,9 @@ public function less()
 	 */
 	public function delete()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app   = JFactory::getApplication();
 		$model = $this->getModel();
 		$id    = $app->input->get('id');
@@ -412,6 +415,9 @@ public function delete()
 	 */
 	public function createFile()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app      = JFactory::getApplication();
 		$model    = $this->getModel();
 		$id       = $app->input->get('id');
@@ -456,6 +462,9 @@ public function createFile()
 	 */
 	public function uploadFile()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app      = JFactory::getApplication();
 		$model    = $this->getModel();
 		$id       = $app->input->get('id');
@@ -487,6 +496,9 @@ public function uploadFile()
 	 */
 	public function createFolder()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app      = JFactory::getApplication();
 		$model    = $this->getModel();
 		$id       = $app->input->get('id');
@@ -523,6 +535,9 @@ public function createFolder()
 	 */
 	public function deleteFolder()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app      = JFactory::getApplication();
 		$model    = $this->getModel();
 		$id       = $app->input->get('id');
@@ -564,6 +579,9 @@ public function deleteFolder()
 	 */
 	public function renameFile()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app     = JFactory::getApplication();
 		$model   = $this->getModel();
 		$id      = $app->input->get('id');
@@ -673,6 +691,9 @@ public function resizeImage()
 	 */
 	public function copyFile()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app      = JFactory::getApplication();
 		$id       = $app->input->get('id');
 		$file     = $app->input->get('file');
@@ -708,6 +729,9 @@ public function copyFile()
 	 */
 	public function extractArchive()
 	{
+		// Check for request forgeries
+		JSession::checkToken() or jexit(JText::_('JINVALID_TOKEN'));
+
 		$app   = JFactory::getApplication();
 		$id    = $app->input->get('id');
 		$file  = $app->input->get('file');

administrator/components/com_templates/models/template.php

@@ -439,7 +439,17 @@ public function &getSource()
 			$input    = JFactory::getApplication()->input;
 			$fileName = base64_decode($input->get('file'));
 			$client   = JApplicationHelper::getClientInfo($this->template->client_id);
-			$filePath = JPath::clean($client->path . '/templates/' . $this->template->element . '/' . $fileName);
+
+
+			try
+			{
+				$filePath = JPath::check($client->path . '/templates/' . $this->template->element . '/' . $fileName);
+			}
+			catch (Exception $e)
+			{
+				$app->enqueueMessage(JText::_('COM_TEMPLATES_ERROR_SOURCE_FILE_NOT_FOUND'), 'error');
+				return;
+			}
 
 			if (file_exists($filePath))
 			{