Created
March 11, 2016 19:21
-
-
Save cedriczirtacic/767c8dd7b2a88e87bf05 to your computer and use it in GitHub Desktop.
Fix for Local File Inclusion (CWE-98) on sarg 0.6.10 pfSense package
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- sarg_frame.php.old 2016-03-11 14:25:58.000000000 -0300 | |
| +++ sarg_frame.php 2016-03-11 16:09:53.000000000 -0300 | |
| @@ -34,6 +34,11 @@ | |
| ini_set('memory_limit', '250M'); | |
| } | |
| +// Small security check | |
| +if(!empty($_REQUEST['file'])){ | |
| + $_REQUEST['file']=preg_replace('/(\.+\/|\\\.*|\/{2,})*/',"", $_REQUEST['file']); | |
| +} | |
| + | |
| if (preg_match("/(\S+)\W(\w+.html)/", $_REQUEST['file'], $matches)) { | |
| // URL format | |
| // https://192.168.1.1/sarg_reports.php?file=2012Mar30-2012Mar30/index.html |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment