← All changes | framework/mvc/controller.inc.php +42 -5 11.6 → 12.0.4 View file →

		@@ -109,8 +109,10 @@
109	109	// Initialize hookable!
110	110	parent::__construct();
111	111	// Read request parameters.
112	112	$this->request = array_merge(((array) $_REQUEST), ((array) $request));
	113	+
	114	+ $overrideControllerPath = $overrideControllerPath ? null : '';
113	115	// Create default model.
114	116	if (isset($this->controllerInfo['model'])) {
115	117	// E_ALL complain!
116	118	if (!isset($this->controllerInfo['model_file'])) {
		@@ -124,9 +126,9 @@
124	126	}
125	127	// Create default view.
126	128	if ($hasView === null) { // Default value for $hasView = true
127	129	// Request/passed parameters has priority over controller default view!
128		- $view = $this->ongetviewname(isset($this->request['view']) ? $this->request['view'] :
	130	+ $view = $this->ongetviewname(isset($this->request['view']) ? esc_html($this->request['view']) :
129	131	(isset($this->controllerInfo['view']) ? $this->controllerInfo['view'] : null)
130	132	);
131	133	if ($view) {
132	134	$this->view = self::getView($view,
		@@ -147,9 +149,9 @@
147	149	public function _doAction() {
148	150	// Force use of internal action untless its empty
149	151	// then look for submitted action or get the default!
150	152	$action = $this->action ? $this->action :
151		- (isset($_GET['action']) ? $_GET['action'] : $this->defaultAction);
	153	+ (isset($_GET['action']) ? esc_html($_GET['action']) : $this->defaultAction);
152	154	// filter action name!
153	155	$action = $this->ongetactionname($action);
154	156	if ($action) {
155	157	$actionHandler = "{$action}Action";
		@@ -173,8 +175,13 @@
173	175	$hasView = null,
174	176	$request = null,
175	177	$overrideControllersPath = null,
176	178	$overrideControllersPrefix = null) {
	179	+ // Validate controller name to prevent path traversal attacks
	180	+ if (!self::isValidControllerName($name)) {
	181	+ throw new Exception('Invalid controller name: ' . esc_html($name));
	182	+ }
	183	+
177	184	// Import controller file.
178	185	$pathToControllers = $overrideControllersPath ? $overrideControllersPath : CJTOOLBOX_CONTROLLERS_PATH;
179	186	$controllerFile = "{$pathToControllers}/{$name}.php";
180	187	require_once self::trigger('CJTController.loadcontroller', $controllerFile, $name);
		@@ -184,8 +191,38 @@
184	191	return new $class($hasView, $request, $overrideControllersPath, $overrideControllersPrefix);
185	192	}
186	193
187	194	/**
	195	+ * Validate controller name to prevent path traversal attacks
	196	+ *
	197	+ * @param string $name Controller name to validate
	198	+ * @return bool True if valid, false otherwise
	199	+ */
	200	+ private static function isValidControllerName($name) {
	201	+ // Check for null or empty string
	202	+ if (empty($name) || !is_string($name)) {
	203	+ return false;
	204	+ }
	205	+
	206	+ // Check for path traversal attempts
	207	+ if (strpos($name, '..') !== false) {
	208	+ return false;
	209	+ }
	210	+
	211	+ // Check for directory separators
	212	+ if (strpos($name, '/') !== false || strpos($name, '\\') !== false) {
	213	+ return false;
	214	+ }
	215	+
	216	+ // Only allow alphanumeric characters, hyphens, and underscores
	217	+ if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name)) {
	218	+ return false;
	219	+ }
	220	+
	221	+ return true;
	222	+ }
	223	+
	224	+ /**
188	225	* put your comment there...
189	226	*
190	227	* @deprecated Use cssJSToolbox::createSecurityToken
191	228	*/
		@@ -198,9 +235,9 @@
198	235	*
199	236	*/
200	237	protected function displayAction() {
201	238	// Get view layout!
202		- $layout = isset($this->request['layout']) ? $this->request['layout'] : 'default';
	239	+ $layout = isset($this->request['layout']) ? esc_html($this->request['layout']) : 'default';
203	240	ob_start();
204	241	$this->view->display($layout);
205	242	$content = ob_get_clean();
206	243	return $content;
		@@ -273,9 +310,9 @@
273	310	*
274	311	* @param mixed $name
275	312	*/
276	313	public function getRequestParameter($name) {
277		- return isset($this->request[$name]) ? $this->request[$name] : null;
	314	+ return isset($this->request[$name]) ? esc_html($this->request[$name]) : null;
278	315	}
279	316
280	317	/**
281	318	*
		@@ -346,5 +383,5 @@
346	383
347	384	} // End class.
348	385
349	386	// Hookable!
350		-CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));
	387	+CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));