Fix for Bug 880699

restorer.php security patch
openshift · Dec 5, 2012 · 32564a0 · 32564a0
1 parent f5d91bb
commit 32564a0
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/node-util/www/html/restorer.php b/node-util/www/html/restorer.php
@@ -1,10 +1,16 @@
 <?php
 
 list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
-shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
-
-sleep(2);
-$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
-header("Location: $url");
-
+if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
+    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
+    sleep(2);
+    $host = $_SERVER['HTTP_HOST'];
+    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
+    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
+    header("Location: $proto$host$url");
+} else {
+    // someone is trying to attack
+    error_log("Invalid uuid $uuid given to restorer.php");
+    header('HTTP/1.0 403 Forbidden');
+}
 ?>