| @@ -103,9 +103,9 @@ | ||
| 103 | 103 | * @return CJTController |
| 104 | 104 | */ |
| 105 | 105 | public function __construct($hasView = null, |
| 106 | 106 | $request = null, |
| 107 | - $overrideControllerPath = '', | |
| 107 | + $overrideControllerPath = null, | |
| 108 | 108 | $overrideContollerPrefix = null) { |
| 109 | 109 | // Initialize hookable! |
| 110 | 110 | parent::__construct(); |
| 111 | 111 | // Read request parameters. |
| @@ -175,8 +175,13 @@ | ||
| 175 | 175 | $hasView = null, |
| 176 | 176 | $request = null, |
| 177 | 177 | $overrideControllersPath = null, |
| 178 | 178 | $overrideControllersPrefix = null) { |
| 179 | + // Validate controller name to prevent path traversal attacks | |
| 180 | + if (!self::isValidControllerName($name)) { | |
| 181 | + throw new Exception('Invalid controller name: ' . esc_html($name)); | |
| 182 | + } | |
| 183 | + | |
| 179 | 184 | // Import controller file. |
| 180 | 185 | $pathToControllers = $overrideControllersPath ? $overrideControllersPath : CJTOOLBOX_CONTROLLERS_PATH; |
| 181 | 186 | $controllerFile = "{$pathToControllers}/{$name}.php"; |
| 182 | 187 | require_once self::trigger('CJTController.loadcontroller', $controllerFile, $name); |
| @@ -183,8 +188,38 @@ | ||
| 183 | 188 | // Get controller class name. |
| 184 | 189 | $class = self::getClassName($name, 'Controller', $overrideControllersPrefix); |
| 185 | 190 | // Instantiate controller class. |
| 186 | 191 | return new $class($hasView, $request, $overrideControllersPath, $overrideControllersPrefix); |
| 192 | + } | |
| 193 | + | |
| 194 | + /** | |
| 195 | + * Validate controller name to prevent path traversal attacks | |
| 196 | + * | |
| 197 | + * @param string $name Controller name to validate | |
| 198 | + * @return bool True if valid, false otherwise | |
| 199 | + */ | |
| 200 | + private static function isValidControllerName($name) { | |
| 201 | + // Check for null or empty string | |
| 202 | + if (empty($name) || !is_string($name)) { | |
| 203 | + return false; | |
| 204 | + } | |
| 205 | + | |
| 206 | + // Check for path traversal attempts | |
| 207 | + if (strpos($name, '..') !== false) { | |
| 208 | + return false; | |
| 209 | + } | |
| 210 | + | |
| 211 | + // Check for directory separators | |
| 212 | + if (strpos($name, '/') !== false || strpos($name, '\\') !== false) { | |
| 213 | + return false; | |
| 214 | + } | |
| 215 | + | |
| 216 | + // Only allow alphanumeric characters, hyphens, and underscores | |
| 217 | + if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name)) { | |
| 218 | + return false; | |
| 219 | + } | |
| 220 | + | |
| 221 | + return true; | |
| 187 | 222 | } |
| 188 | 223 | |
| 189 | 224 | /** |
| 190 | 225 | * put your comment there... |
