oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

modernize include macro slightly and add note about security

Browse source
This commit is contained in:
Graham Knop 2012-11-17 15:56:52 -05:00
parent 759c93cbe3
commit 76b638ddb9
1 changed files with 11 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/WebGUI/Macro/Include.pm
View file

@ -11,7 +11,6 @@ package WebGUI::Macro::Include;
#------------------------------------------------------------------- #-------------------------------------------------------------------
use strict; use strict;
use FileHandle;
use WebGUI::International; use WebGUI::International;
=head1 NAME =head1 NAME
@ -21,6 +20,8 @@ Package WebGUI::Macro::Include
=head1 DESCRIPTION =head1 DESCRIPTION
Macro for returning the contents of a file from the filesystem. Macro for returning the contents of a file from the filesystem.
This macro is an extreme security risk and you are advised not to
use it.
=head2 process ( filename ) =head2 process ( filename )
@ -37,21 +38,14 @@ The complete path to a file in the local filesystem.
#------------------------------------------------------------------- #-------------------------------------------------------------------
sub process { sub process {
my $session = shift; my $session = shift;
my (@param, $temp, $file); my $filename = shift;
@param = @_;
my $i18n = WebGUI::International->new($session,'Macro_Include'); my $i18n = WebGUI::International->new($session,'Macro_Include');
if ($param[0] =~ /passwd/i || $param[0] =~ /shadow/i || $param[0] =~ m{\.conf$}i) { if ($filename =~ /passwd/i || $filename =~ /shadow/i || $filename =~ m{\.conf$}i) {
return $i18n->get('security'); return $i18n->get('security');
} }
$file = FileHandle->new($param[0],"r"); open my $fh, '<', $filename
if ($file) { or return $i18n->get('not found');
local $/; return scalar do { local $/; readline $fh };
$temp = $file->getline();
$file->close;
} else {
$temp = $i18n->get('not found');
}
return $temp;
} }