|
-
|
-
diff --git a/contributions/punycode/3rdparty/idna_convert/uctc.php b/contributions/punycode/3rdparty/idna_convert/uctc.php
index ea5e4769..24ed9a67 100644
--- a/contributions/punycode/3rdparty/idna_convert/uctc.php
+++ b/contributions/punycode/3rdparty/idna_convert/uctc.php
@@ -39,8 +39,8 @@ public static function convert($data, $from, $to, $safe_mode = false, $safe_char
if (self::$safe_mode) self::$allow_overlong = true;
if (!in_array($from, self::$mechs)) throw new Exception('Invalid input format specified');
if (!in_array($to, self::$mechs)) throw new Exception('Invalid output format specified');
- if ($from != 'ucs4array') eval('$data = self::'.$from.'_ucs4array($data);');
- if ($to != 'ucs4array') eval('$data = self::ucs4array_'.$to.'($data);');
+ if ($from != 'ucs4array') $data = call_user_func(array('self', $from.'_ucs4array'), $data);
+ if ($to != 'ucs4array') $data = call_user_func(array('self', 'ucs4array_'.$to), $data);
return $data;
}
diff --git a/contributions/sphinx/model/drivers/sphinx/dbdriver.sphinx.php b/contributions/sphinx/model/drivers/sphinx/dbdriver.sphinx.php
index 00711763..befbf0e1 100644
--- a/contributions/sphinx/model/drivers/sphinx/dbdriver.sphinx.php
+++ b/contributions/sphinx/model/drivers/sphinx/dbdriver.sphinx.php
@@ -202,7 +202,7 @@ public function execute($sql) {
public function query($query) {
$this->connect();
- $arr_query = unserialize($query);
+ $arr_query = unserialize($query, ['allowed_classes' => false]);
$features = Arr::get_item($arr_query, 'features', false);
$terms = Arr::get_item_recursive($arr_query, 'conditions[query]', '');
diff --git a/contributions/usermanagement.notifications/model/classes/notificationssettings.model.php b/contributions/usermanagement.notifications/model/classes/notificationssettings.model.php
index ca32d6a1..b30edb40 100644
--- a/contributions/usermanagement.notifications/model/classes/notificationssettings.model.php
+++ b/contributions/usermanagement.notifications/model/classes/notificationssettings.model.php
@@ -140,7 +140,7 @@ public function source_matches($source, $type) {
*/
protected function create_feed_token() {
$user = Users::get($this->id_user);
- $seed = rand(1000000, 9999999);
+ $seed = random_int(1000000, 9999999);
if ($user) {
$seed .= $user->password . $user->creationdate;
}
diff --git a/contributions/usermanagement/behaviour/commands/users/hashes/bcrypt.hash.php b/contributions/usermanagement/behaviour/commands/users/hashes/bcrypt.hash.php
new file mode 100644
index 00000000..3d1a1171
--- /dev/null
+++ b/contributions/usermanagement/behaviour/commands/users/hashes/bcrypt.hash.php
@@ -0,0 +1,16 @@
+ 12]);
+ }
+
+ public function check($source, $hash) {
+ return password_verify($source, $hash);
+ }
+}
diff --git a/contributions/usermanagement/behaviour/commands/users/hashes/md5.hash.php b/contributions/usermanagement/behaviour/commands/users/hashes/md5.hash.php
index 07287c15..0e44502e 100644
--- a/contributions/usermanagement/behaviour/commands/users/hashes/md5.hash.php
+++ b/contributions/usermanagement/behaviour/commands/users/hashes/md5.hash.php
@@ -13,6 +13,6 @@ public function hash($source) {
}
public function check($source, $hash) {
- return $hash == $this->hash($source);
+ return hash_equals($hash, $this->hash($source));
}
}
\ No newline at end of file
diff --git a/contributions/usermanagement/behaviour/commands/users/hashes/sha1.hash.php b/contributions/usermanagement/behaviour/commands/users/hashes/sha1.hash.php
index 3e02b381..765aad84 100644
--- a/contributions/usermanagement/behaviour/commands/users/hashes/sha1.hash.php
+++ b/contributions/usermanagement/behaviour/commands/users/hashes/sha1.hash.php
@@ -13,6 +13,6 @@ public function hash($source) {
}
public function check($source, $hash) {
- return $hash == $this->hash($source);
+ return hash_equals($hash, $this->hash($source));
}
}
diff --git a/gyro/core/lib/helpers/common.cls.php b/gyro/core/lib/helpers/common.cls.php
index cbafd1da..7dee4e0b 100644
--- a/gyro/core/lib/helpers/common.cls.php
+++ b/gyro/core/lib/helpers/common.cls.php
@@ -285,17 +285,17 @@ public static function is_google() {
* @return string
*/
public static function create_token($salt = false) {
- return sha1(uniqid($salt ? $salt : mt_rand(), true));
+ return bin2hex(random_bytes(20));
}
/**
* Creates a token, which is 64 characters long
*
- * @param string|false $salt Optional extra salt, if omitted mt_rand() is used
+ * @param string|false $salt Optional extra salt (unused, kept for API compatibility)
* @return string
*/
public static function create_long_token($salt = false) {
- return hash('sha3-256', uniqid($salt ? $salt : mt_rand(), true));
+ return bin2hex(random_bytes(32));
}
/**
diff --git a/gyro/core/lib/helpers/converters/htmlex.converter.php b/gyro/core/lib/helpers/converters/htmlex.converter.php
index ea91f386..93f40911 100644
--- a/gyro/core/lib/helpers/converters/htmlex.converter.php
+++ b/gyro/core/lib/helpers/converters/htmlex.converter.php
@@ -19,7 +19,7 @@ class ConverterHtmlEx extends ConverterHtml {
protected function process_paragraph($text, $params) {
if (GyroString::length($text) <= 70 && GyroString::right($text, 1) != '.') {
$level = intval(Arr::get_item($params, 'h', 2));
- return html::tag('h' . $level, $text);
+ return html::tag('h' . $level, GyroString::escape($text));
}
else {
return parent::process_paragraph($text, $params);
diff --git a/gyro/core/lib/helpers/requestinfo.cls.php b/gyro/core/lib/helpers/requestinfo.cls.php
index c961dcf3..7e23606f 100644
--- a/gyro/core/lib/helpers/requestinfo.cls.php
+++ b/gyro/core/lib/helpers/requestinfo.cls.php
@@ -112,12 +112,13 @@ protected function compute_url_invoked($type) {
}
if ($type == self::ABSOLUTE) {
$prefix = $this->is_ssl() ? 'https://' : 'http://';
- // Check proxy forwarded stuff
- $prefix .= Arr::get_item(
- $_SERVER, 'HTTP_X_FORWARDED_HOST', Arr::get_item(
- $_SERVER, 'HTTP_HOST', Config::get_value(Config::URL_DOMAIN)
- )
- );
+ $configured_domain = Config::get_value(Config::URL_DOMAIN);
+ $host = Arr::get_item($_SERVER, 'HTTP_HOST', $configured_domain);
+ // Validate host against configured domain to prevent host header injection
+ if (!empty($configured_domain) && $host !== $configured_domain) {
+ $host = $configured_domain;
+ }
+ $prefix .= $host;
$ret = $prefix . $ret;
}
return $ret;
diff --git a/gyro/core/lib/helpers/session.cls.php b/gyro/core/lib/helpers/session.cls.php
index 5012835e..742b9482 100644
--- a/gyro/core/lib/helpers/session.cls.php
+++ b/gyro/core/lib/helpers/session.cls.php
@@ -1,9 +1,11 @@
= 0) {
+ setcookie(session_name(), session_id(), [
+ 'expires' => $expire,
+ 'path' => $cookie_params['path'],
+ 'domain' => $cookie_params['domain'],
+ 'secure' => $cookie_params['secure'],
+ 'httponly' => $cookie_params['httponly'],
+ 'samesite' => 'Lax'
+ ]);
+ } else {
+ setcookie(
+ session_name(), session_id(), $expire,
+ $cookie_params['path'], $cookie_params['domain'],
+ $cookie_params['secure'], $cookie_params['httponly']
+ );
+ }
}
/**
diff --git a/gyro/core/model/base/fields/dbfield.serialized.cls.php b/gyro/core/model/base/fields/dbfield.serialized.cls.php
index 172fa046..261dd020 100644
--- a/gyro/core/model/base/fields/dbfield.serialized.cls.php
+++ b/gyro/core/model/base/fields/dbfield.serialized.cls.php
@@ -40,7 +40,7 @@ protected function do_format_not_null($value) {
* @return mixed
*/
public function convert_result($value) {
- return is_null($value) ? null : unserialize($value);
+ return is_null($value) ? null : unserialize($value, ['allowed_classes' => false]);
}
/**
@@ -51,7 +51,7 @@ public function convert_result($value) {
public function get_field_default() {
$ret = parent::get_field_default();
if ($ret) {
- $ret = unserialize($ret);
+ $ret = unserialize($ret, ['allowed_classes' => false]);
}
return $ret;
}
diff --git a/gyro/core/model/drivers/mysql/dbdriver.mysql.php b/gyro/core/model/drivers/mysql/dbdriver.mysql.php
index 1f2b1b21..3155a5d8 100644
--- a/gyro/core/model/drivers/mysql/dbdriver.mysql.php
+++ b/gyro/core/model/drivers/mysql/dbdriver.mysql.php
@@ -144,8 +144,10 @@ public function quote($value) {
*/
public function escape_database_entity($obj, $type = self::FIELD) {
$ret = '';
+ $obj = str_replace('`', '``', $obj);
if ($type === self::TABLE) {
- $ret .= '`' . $this->get_db_name() . '`.';
+ $db_name = str_replace('`', '``', $this->get_db_name());
+ $ret .= '`' . $db_name . '`.';
}
$ret .= '`' . $obj . '`';
return $ret;
diff --git a/gyro/core/view/base/pageviewbase.cls.php b/gyro/core/view/base/pageviewbase.cls.php
index 77a48fd3..b6cc2411 100644
--- a/gyro/core/view/base/pageviewbase.cls.php
+++ b/gyro/core/view/base/pageviewbase.cls.php
@@ -91,7 +91,10 @@ protected function render_postprocess(&$rendered_content, $policy) {
}
GyroHeaders::set('Vary', 'Accept-Encoding', false);
GyroHeaders::set('Date', GyroDate::http_date(time()), true);
-
+ GyroHeaders::set('X-Content-Type-Options', 'nosniff', false);
+ GyroHeaders::set('X-Frame-Options', 'SAMEORIGIN', false);
+ GyroHeaders::set('Referrer-Policy', 'strict-origin-when-cross-origin', false);
+
GyroHeaders::send();
}
}
diff --git a/gyro/install/check_preconditions.php b/gyro/install/check_preconditions.php
index 0d181937..23905c18 100644
--- a/gyro/install/check_preconditions.php
+++ b/gyro/install/check_preconditions.php
@@ -12,16 +12,12 @@ function core_check_preconditions() {
foreach($subdirs as $subdir) {
$dir = rtrim($tempdir . $subdir, '/');
if (!file_exists($dir)) {
- $cmd = 'mkdir -p ' . $dir;
- if (shell_exec($cmd)) {
- $ret->append('Could not create temporary directory ' . $dir);
- }
- else {
- chmod($dir, 0777);
+ if (!@mkdir($dir, 0755, true)) {
+ $ret->append('Could not create temporary directory ' . $dir);
}
}
// Try to place file into temp dir
- $file = $dir . '/test' . md5(uniqid());
+ $file = $dir . '/test' . bin2hex(random_bytes(16));
if (touch($file)) {
unlink($file);
}
diff --git a/gyro/modules/phpinfo/controller/phpinfo.controller.php b/gyro/modules/phpinfo/controller/phpinfo.controller.php
index afb86d87..ae49c098 100644
--- a/gyro/modules/phpinfo/controller/phpinfo.controller.php
+++ b/gyro/modules/phpinfo/controller/phpinfo.controller.php
@@ -37,6 +37,9 @@ public function get_routes() {
* @return void
*/
public function action_phpinfo(PageData $page_data) {
+ if (!Config::has_feature(Config::TESTMODE)) {
+ return self::NOT_FOUND;
+ }
print phpinfo();
exit;
}
|