diff --git a/classes/modules/staticModule.php b/classes/modules/staticModule.php index 4ce161df9c0e3191b0b3a2b9e5eb9a66631b9406..746f6a5e5ef9ed1c6494f21a2de000c0fbd0dfa6 100644 --- a/classes/modules/staticModule.php +++ b/classes/modules/staticModule.php @@ -24,17 +24,9 @@ class StaticModule extends abstractModule{ global $uri; global $acceptContentType; global $endpoints; - global $lodspk; - - $staticdir = realpath($conf['static']['directory']); - $imgdir = realpath($conf['static']['directory'] . "img"); - $resourcepath = realpath($conf['static']['directory'].$file); - - // static resources should be in static or img dir (img may be symlinked, check realpath of img as well) - if (strpos($resourcepath, $staticdir)!== 0 and strpos($resourcepath, $imgdir)!== 0) { - HTTPStatus::send404($file); // send404 calls exit();// - } - $filenamearray =explode(".",$file); + global $lodspk; + $this->validateDirectory($conf, $file); + $filenamearray =explode(".",$file); $extension = end($filenamearray); $ct = $this->getContentType($extension); header("Content-type: ".$ct); @@ -95,8 +87,26 @@ class StaticModule extends abstractModule{ } return ""; //empty string seems to work fine with browsers } - - + + /** + * Validate that resource directory is valid and safe to use. + * + * @param array $conf + * Global configuration. + * @param $file + * + * @return void + */ + private function validateDirectory(array $conf, $file): void + { + $staticdir = realpath($conf['static']['directory']); + $imgdir = realpath($conf['static']['directory'] . "img"); + $resourcepath = realpath($conf['static']['directory'].$file); + + // static resources should be in static or img dir (img may be symlinked, check realpath of img as well) + if (strpos($resourcepath, $staticdir)!== 0 and strpos($resourcepath, $imgdir)!== 0) { + HTTPStatus::send404($file); // send404 calls exit();// + } + } } -?>