← All changes | framework/access-points/access-point.class.php +34 -2 11.9 → 12.0.4 View file →

		@@ -113,10 +113,42 @@
113	113	if ($accessPointClassLoader) {
114	114	$this->overrideControllersPath = $accessPointClassLoader->getPath() . DIRECTORY_SEPARATOR . 'controllers';
115	115	$this->overrideControllersPrefix = $accessPointClassLoader->getPrefix();
116	116	}
117		- // Initialize!
118		- $this->controllerName = $this->ongetdefaultcontrollername(isset($_REQUEST['controller']) ? esc_html($_REQUEST['controller']) : $defaultController);
	117	+ // Initialize with validation!
	118	+ $requestedController = isset($_REQUEST['controller']) ? esc_html($_REQUEST['controller']) : $defaultController;
	119	+ $this->controllerName = $this->ongetdefaultcontrollername($this->sanitizeControllerName($requestedController, $defaultController));
	120	+ }
	121	+
	122	+ /**
	123	+ * Sanitize controller name to prevent path traversal attacks
	124	+ *
	125	+ * @param string $controllerName The requested controller name
	126	+ * @param string $defaultController The default controller to use if validation fails
	127	+ * @return string Safe controller name
	128	+ */
	129	+ private function sanitizeControllerName($controllerName, $defaultController) {
	130	+ // Check for null or empty string
	131	+ if (empty($controllerName) || !is_string($controllerName)) {
	132	+ return $defaultController;
	133	+ }
	134	+
	135	+ // Check for path traversal attempts
	136	+ if (strpos($controllerName, '..') !== false) {
	137	+ return $defaultController;
	138	+ }
	139	+
	140	+ // Check for directory separators
	141	+ if (strpos($controllerName, '/') !== false || strpos($controllerName, '\\') !== false) {
	142	+ return $defaultController;
	143	+ }
	144	+
	145	+ // Only allow alphanumeric characters, hyphens, and underscores
	146	+ if (!preg_match('/^[a-zA-Z0-9_-]+$/', $controllerName)) {
	147	+ return $defaultController;
	148	+ }
	149	+
	150	+ return $controllerName;
119	151	}
120	152
121	153	/**
122	154	* put your comment there...