adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-31 06:02:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

File Manipulation #536

New Issue
Closed
opened 2026-10-05 00:02:44 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:02:44 +02:00
Owner
Copy link
Copy source

In Piwigo/install.php:

120: $filename = PHPWG_ROOT_PATH . $conf['data_location'] . 'pwg_' . $_GET['dl'];
127: unlink($filename);

As you can see, unlink() is being used to with a usercontrolled parameter dl, one can use path manipulation techniques like /../ and refer to files and get them removed by unlink(). this isn't as critical as the install.php file gets removed after install, it is when it isn't.

Thanks,

In Piwigo/install.php: 120: $filename = PHPWG_ROOT_PATH . $conf['data_location'] . 'pwg_' . $_GET['dl']; 127: unlink($filename); As you can see, unlink() is being used to with a usercontrolled parameter dl, one can use path manipulation techniques like /../ and refer to files and get them removed by unlink(). this isn't as critical as the install.php file gets removed after install, it is when it isn't. Thanks, <!-- github-sync-id:196307930 -->
adam closed this issue 2026-10-05 00:02:44 +02:00
adam commented 2026-10-05 00:02:45 +02:00
Author
Owner
Copy link
Copy source

Hi @Shinkurt

Did you also see:

116: check_input_parameter('dl', $_GET, false, '/^[a-f0-9]{32}$/');

It should prevent any "../../" attempt :-)

Hi @Shinkurt Did you also see: ``` 116: check_input_parameter('dl', $_GET, false, '/^[a-f0-9]{32}$/'); ``` It should prevent any "../../" attempt :-) <!-- github-comment-id:267927776 -->
adam commented 2026-10-05 00:02:46 +02:00
Author
Owner
Copy link
Copy source

@plegall yeah, that is one thing I'd like to mention. that parameter, although checks the input, it doesn't exit() if it occurs. check_input_parameter(), instead of closing with a die() or exit() if they are encountered, it instead calls fatal_error() which basically just prints out error. but adding a die or exit in that function will solve it.

Thanks,

@plegall yeah, that is one thing I'd like to mention. that parameter, although checks the input, it doesn't exit() if it occurs. check_input_parameter(), instead of closing with a die() or exit() if they are encountered, it instead calls fatal_error() which basically just prints out error. but adding a die or exit in that function will solve it. Thanks, <!-- github-comment-id:267973710 -->
adam commented 2026-10-05 00:02:46 +02:00
Author
Owner
Copy link
Copy source

here is the end of fatal_error function:

  die(0); // just in case

it seems good enough for me :-)

here is the end of fatal_error function: ``` die(0); // just in case ``` it seems good enough for me :-) <!-- github-comment-id:268248713 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#536