IMPORTANT SECURITY FIX: this prevents bad characters being passed to help.php

diff --git a/help.php b/help.php
index 6a112140092f618e82fbb951974da0a0e4633f78..abcfb995d413c6c768bfbc7a3f20751080f91e73 100644 (file)
--- a/help.php
+++ b/help.php
@@ -14,8 +14,8 @@
 
   print_header();
 
-  if (ereg("\\.\\.", $file)) {
-      error("Filenames can not contain \"..\"");
+  if (detect_munged_arguments("$module/$file")) {
+      error("Filenames contain illegal characters!");
   }
 
   if ($file) {
@@ -28,7 +28,7 @@
         if (file_exists("$filepath")) {
             require_once("$filepath");           // Chosen language
 
-        } else {                            // Fall back to English
+        } else {                                 // Fall back to English
             if ($module == "moodle") {
                 $filepath = "$CFG->dirroot/lang/en/help/$file";
             } else {
@@ -43,13 +43,13 @@
             }
         }
     } else {
-        echo "<P>";
+        echo "<p>";
         echo $text;
-        echo "</P>";
+        echo "</p>";
     }
 
     close_window_button();
 ?>
-</BODY>
-</HTML>
+</body>
+</html>
 

diff --git a/lib/weblib.php b/lib/weblib.php
index 32a4970b84a47099e1d841002a5dfa613a2e230a..de56c773abf3783eafa3afc65d8a863bd1aad4ce 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -378,6 +378,19 @@ function validate_email ($address) {
                   $address));
 }
 
+function detect_munged_arguments($string) {
+    if (ereg("\.\.", $string)) { // check for parent URLs
+        return true;
+    }
+    if (ereg("\|", $string)) {  // check for pipes
+        return true;
+    }
+    if (ereg("\'", $string)) {  // check for backquotes
+        return true;
+    }
+    return false;
+}
+
 function get_slash_arguments($file="file.php") {
 /// Searches the current environment variables for some slash arguments
 
@@ -398,16 +411,9 @@ function parse_slash_arguments($string, $i=0) {
 /// Extracts arguments from "/foo/bar/something"
 /// eg http://mysite.com/script.php/foo/bar/something
 
-    if (strpos($string, "..")) { // check for parent URLs
-        return false;
-    }
-    if (strpos($string, "|")) {  // check for pipes
+    if (detect_munged_arguments($string)) {
         return false;
     }
-    if (strpos($string, "`")) {  // check for backquotes
-        return false;
-    }
-
     $args = explode("/", $string);
 
     if ($i) {     // return just the required argument