| @@ -109,8 +109,10 @@ | ||
| 109 | 109 | // Initialize hookable! |
| 110 | 110 | parent::__construct(); |
| 111 | 111 | // Read request parameters. |
| 112 | 112 | $this->request = array_merge(((array) $_REQUEST), ((array) $request)); |
| 113 | + | |
| 114 | + $overrideControllerPath = $overrideControllerPath ? null : ''; | |
| 113 | 115 | // Create default model. |
| 114 | 116 | if (isset($this->controllerInfo['model'])) { |
| 115 | 117 | // E_ALL complain! |
| 116 | 118 | if (!isset($this->controllerInfo['model_file'])) { |
| @@ -173,8 +175,13 @@ | ||
| 173 | 175 | $hasView = null, |
| 174 | 176 | $request = null, |
| 175 | 177 | $overrideControllersPath = null, |
| 176 | 178 | $overrideControllersPrefix = null) { |
| 179 | + // Validate controller name to prevent path traversal attacks | |
| 180 | + if (!self::isValidControllerName($name)) { | |
| 181 | + throw new Exception('Invalid controller name: ' . esc_html($name)); | |
| 182 | + } | |
| 183 | + | |
| 177 | 184 | // Import controller file. |
| 178 | 185 | $pathToControllers = $overrideControllersPath ? $overrideControllersPath : CJTOOLBOX_CONTROLLERS_PATH; |
| 179 | 186 | $controllerFile = "{$pathToControllers}/{$name}.php"; |
| 180 | 187 | require_once self::trigger('CJTController.loadcontroller', $controllerFile, $name); |
| @@ -181,8 +188,38 @@ | ||
| 181 | 188 | // Get controller class name. |
| 182 | 189 | $class = self::getClassName($name, 'Controller', $overrideControllersPrefix); |
| 183 | 190 | // Instantiate controller class. |
| 184 | 191 | return new $class($hasView, $request, $overrideControllersPath, $overrideControllersPrefix); |
| 192 | + } | |
| 193 | + | |
| 194 | + /** | |
| 195 | + * Validate controller name to prevent path traversal attacks | |
| 196 | + * | |
| 197 | + * @param string $name Controller name to validate | |
| 198 | + * @return bool True if valid, false otherwise | |
| 199 | + */ | |
| 200 | + private static function isValidControllerName($name) { | |
| 201 | + // Check for null or empty string | |
| 202 | + if (empty($name) || !is_string($name)) { | |
| 203 | + return false; | |
| 204 | + } | |
| 205 | + | |
| 206 | + // Check for path traversal attempts | |
| 207 | + if (strpos($name, '..') !== false) { | |
| 208 | + return false; | |
| 209 | + } | |
| 210 | + | |
| 211 | + // Check for directory separators | |
| 212 | + if (strpos($name, '/') !== false || strpos($name, '\\') !== false) { | |
| 213 | + return false; | |
| 214 | + } | |
| 215 | + | |
| 216 | + // Only allow alphanumeric characters, hyphens, and underscores | |
| 217 | + if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name)) { | |
| 218 | + return false; | |
| 219 | + } | |
| 220 | + | |
| 221 | + return true; | |
| 185 | 222 | } |
| 186 | 223 | |
| 187 | 224 | /** |
| 188 | 225 | * put your comment there... |
