oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixed a critical security bug

Browse source
This commit is contained in:
JT Smith 2005-10-11 16:41:00 +00:00
parent 34b7f63bb5
commit ff206a3290
3 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/changelog/6.x.x.txt
View file

@ -10,6 +10,8 @@
- Fixed a pagination bug in the subscription code pagination.
- Added a table of contents to the Help system.
- Documented the Product Macro and internationalized messages inside of it.
- Fixed a critical security bug. Upgrade to this version immediately if
you're using any other version 6.3 or above.
6.7.5
- Fixed a syntax error in Syndicated Content.

13
lib/WebGUI/Asset.pm
View file

@ -973,7 +973,7 @@ sub new {
my $revisionDate = shift || $session{assetRevision}{$assetId}{$session{scratch}{versionTag}||'_'};
unless ($revisionDate) {
($revisionDate) = WebGUI::SQL->quickArray("select max(revisionDate) from assetData where assetId="
.quote($assetId)." and (status='approved' or status='archived' or tagId=".quote($session{scratch}{versionTag}).")
.quote($assetId)." and (status='approved' or status='archived' or status='pending' or tagId=".quote($session{scratch}{versionTag}).")
group by assetData.assetId order by assetData.revisionDate");
$session{assetRevision}{$assetId}{$session{scratch}{versionTag}||'_'} = $revisionDate unless ($session{config}{disableCache});
}
@ -1352,8 +1352,13 @@ Adds a new Asset based upon the class of the current form. Returns the Asset cal
sub www_add {
my $self = shift;
my %prototypeProperties;
my $class = $session{form}{class};
unless ($class =~ m/^[A-Za-z0-9\:]+$/) {
WebGUI::ErrorHandler::security("tried to call an invalid class ".$class);
return "";
}
if ($session{form}{'prototype'}) {
my $prototype = WebGUI::Asset->new($session{form}{'prototype'},$session{form}{class});
my $prototype = WebGUI::Asset->new($session{form}{'prototype'},$class);
foreach my $definition (@{$prototype->definition}) { # cycle through rather than copying properties to avoid grabbing stuff we shouldn't grab
foreach my $property (keys %{$definition->{properties}}) {
next if (isIn($property,qw(title menuTitle url isPrototype isPackage)));
@ -1374,10 +1379,10 @@ sub www_add {
isHidden => $self->get("isHidden"),
startDate => $self->get("startDate"),
endDate => $self->get("endDate"),
className=>$session{form}{class},
className=>$class,
assetId=>"new"
);
$properties{isHidden} = 1 unless (WebGUI::Utility::isIn($session{form}{class}, @{$session{config}{assetContainers}}));
$properties{isHidden} = 1 unless (WebGUI::Utility::isIn($class, @{$session{config}{assetContainers}}));
my $newAsset = WebGUI::Asset->newByPropertyHashRef(\%properties);
$newAsset->{_parent} = $self;
return WebGUI::Privilege::insufficient() unless ($newAsset->canAdd);

2
lib/WebGUI/ErrorHandler.pm
View file

@ -304,7 +304,7 @@ The message you wish to add to the log.
sub security {
my $message = shift;
$Log::Log4perl::caller_depth++;
warn($WebGUI::Session::session{user}{username}." (".$WebGUI::Session::session{user}{userId}.") connecting from "
WebGUI::ErrorHandler::warn($WebGUI::Session::session{user}{username}." (".$WebGUI::Session::session{user}{userId}.") connecting from "
.$WebGUI::Session::session{env}{REMOTE_ADDR}." attempted to ".$message);
$Log::Log4perl::caller_depth--;
}