PHP-Nuke Upload and Execution of Arbitrary Code

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

No however, we'll be issuing a new code addition, and will ask FBC to include into the mainfile. It is:

Code:

function SanitizePath($inpath) {
$outpath = ereg_replace("\.[\.]+", "", $inpath);
$outpath = ereg_replace("^[\/]+", "", $outpath);
$outpath = ereg_replace)"^[A-Za-z][:\|][\/]?", "", $outpath);
return($outpath);
}

This is a code snippet from the "Beginning PHP 4", ISBN: 1-861003-73-0. This was located by IACOJ and its something we need to start integrating into the mainfile.php. I'll be passing this or something similar to Francisco.

Lieutenant Joined: Jul 09, 2003 Posts: 293

Is this going to work in a unix environment? What if the dir has '65' in it? IMHO for this code to work properly one needs to decide when to use it. Using it arbitrarily will break normal directory traversals (images/avatars for instance) in my mind.

Hmm...this has me thinking anyways...

J.

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Yes it'll work in both platforms.