Skip to content

Commit

Permalink
Change method name "method" to "http_method" for http_traversal.rb
Browse files Browse the repository at this point in the history
We accidentally override "#method", which is bad.
  • Loading branch information
wchen-r7 committed Feb 8, 2016
1 parent be8d6df commit cd7046f
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions modules/auxiliary/scanner/http/http_traversal.rb
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,8 @@ def initialize(info = {})


# Avoids writing to datastore['METHOD'] directly
def method
@method || datastore['METHOD']
def http_method
@http_method || datastore['METHOD']
end

# Avoids writing to datastore['DATA'] directly
Expand Down Expand Up @@ -136,7 +136,7 @@ def fuzz
def ini_request(uri)
req = {}

case method
case http_method
when 'GET'
# Example: Say we have the following datastore['PATH']
# '/test.php?page=1&id=3&note=whatever'
Expand All @@ -162,7 +162,7 @@ def ini_request(uri)
this_path = uri
end

req['method'] = method
req['method'] = http_method
req['uri'] = this_path
req['headers'] = {'Cookie'=>datastore['COOKIE']} if not datastore['COOKIE'].empty?
req['data'] = data if not data.empty?
Expand Down Expand Up @@ -225,7 +225,7 @@ def check(trigger)
:proof => trigger,
:name => self.fullname,
:category => "web",
:method => method
:method => http_method
})

else
Expand Down Expand Up @@ -289,9 +289,9 @@ def php_download(files)
#
def is_writable(trigger)
# Modify some registered options for the PUT method
tmp_method = method
tmp_method = http_method
tmp_data = data
@method = 'PUT'
@http_method = 'PUT'

if data.empty?
unique_str = Rex::Text.rand_text_alpha(4) * 4
Expand All @@ -310,7 +310,7 @@ def is_writable(trigger)
send_request_cgi(req, 25)

# Prepare request to read our file
@method = 'GET'
@http_method = 'GET'
@data = tmp_data
req = ini_request(uri)
vprint_status("Verifying upload...")
Expand All @@ -324,7 +324,7 @@ def is_writable(trigger)
end

# Ah, don't forget to restore our method
@method = tmp_method
@http_method = tmp_method
end

#
Expand All @@ -337,8 +337,8 @@ def load_filelist

def run_host(ip)
# Warn if it's not a well-formed UPPERCASE method
if method !~ /^[A-Z]+$/
print_warning("HTTP method #{method} is not Apache-compliant. Try only UPPERCASE letters.")
if http_method !~ /^[A-Z]+$/
print_warning("HTTP method #{http_method} is not Apache-compliant. Try only UPPERCASE letters.")
end
print_status("Running action: #{action.name}...")

Expand Down

0 comments on commit cd7046f

Please sign in to comment.