← All changes | admin/controller.php +39 -15 1.8.12 → 1.8.16 View file →

		@@ -13956,10 +13956,17 @@
13956	13956	* @throws Exception
13957	13957	*/
13958	13958	public function upload_customer_document()
13959	13959	{
13960		- $input = JFactory::getApplication()->input;
	13960	+ $app = JFactory::getApplication();
	13961	+
	13962	+ if (!JSession::checkToken()) {
	13963	+ // missing CSRF-proof token
	13964	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));
	13965	+ }
	13966	+
13961	13967	$dbo = JFactory::getDbo();
	13968	+ $input = $app->input;
13962	13969
13963	13970	$customer_id = $input->getUint('customer', 0);
13964	13971
13965	13972	$result = new stdClass;
		@@ -13978,17 +13985,15 @@
13978	13985	->from($dbo->qn('#__vikbooking_customers'))
13979	13986	->where($dbo->qn('id') . ' = ' . $customer_id);
13980	13987
13981	13988	$dbo->setQuery($q, 0, 1);
13982		- $dbo->execute();
	13989	+ $customer = $dbo->loadObject();
13983	13990
13984		- if (!$dbo->getNumRows())
	13991	+ if (!$customer)
13985	13992	{
13986	13993	throw new Exception(sprintf('Customer [%d] not found', $customer_id), 404);
13987	13994	}
13988	13995
13989		- $customer = $dbo->loadObject();
13990		-
13991	13996	// fetch documents folder path
13992	13997	$dirpath = VBO_CUSTOMERS_PATH . DIRECTORY_SEPARATOR;
13993	13998
13994	13999	// check if we have a valid directory
		@@ -14043,10 +14048,9 @@
14043	14048	$result->error = $e->getMessage();
14044	14049	$result->code = $e->getCode();
14045	14050	}
14046	14051
14047		- echo json_encode($result);
14048		- exit;
	14052	+ VBOHttpDocument::getInstance($app)->json($result);
14049	14053	}
14050	14054
14051	14055	/**
14052	14056	* AJAX delete the customer documents.
		@@ -14056,10 +14060,21 @@
14056	14060	* @throws Exception
14057	14061	*/
14058	14062	public function delete_customer_document()
14059	14063	{
14060		- $input = JFactory::getApplication()->input;
	14064	+ $app = JFactory::getApplication();
	14065	+
	14066	+ if (!JSession::checkToken()) {
	14067	+ // missing CSRF-proof token
	14068	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));
	14069	+ }
	14070	+
	14071	+ if (!JFactory::getUser()->authorise('core.delete', 'com_vikbooking')) {
	14072	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
	14073	+ }
	14074	+
14061	14075	$dbo = JFactory::getDbo();
	14076	+ $input = $app->input;
14062	14077
14063	14078	$customer_id = $input->getUint('customer', 0);
14064	14079
14065	14080	$result = new stdClass;
		@@ -14074,9 +14089,9 @@
14074	14089	$dbo->execute();
14075	14090
14076	14091	if (!$dbo->getNumRows())
14077	14092	{
14078		- throw new Exception(sprintf('Customer [%d] not found', $customer_id), 404);
	14093	+ VBOHttpDocument::getInstance($app)->close(404, sprintf('Customer [%d] not found', $customer_id));
14079	14094	}
14080	14095
14081	14096	$folder = $dbo->loadResult();
14082	14097
		@@ -14081,9 +14096,9 @@
14081	14096	$folder = $dbo->loadResult();
14082	14097
14083	14098	if (!$folder)
14084	14099	{
14085		- throw new Exception('The customer does not have any documents', 500);
	14100	+ VBOHttpDocument::getInstance($app)->close(500, 'The customer does not have any documents');
14086	14101	}
14087	14102
14088	14103	$file = $input->getString('file');
14089	14104
		@@ -14088,9 +14103,9 @@
14088	14103	$file = $input->getString('file');
14089	14104
14090	14105	if (!$file)
14091	14106	{
14092		- throw new Exception('File to remove not specified', 400);
	14107	+ VBOHttpDocument::getInstance($app)->close(400, 'File to remove not specified');
14093	14108	}
14094	14109
14095	14110	$path = implode(DIRECTORY_SEPARATOR, array(VBO_CUSTOMERS_PATH, $folder, $file));
14096	14111
		@@ -14095,17 +14110,26 @@
14095	14110	$path = implode(DIRECTORY_SEPARATOR, array(VBO_CUSTOMERS_PATH, $folder, $file));
14096	14111
14097	14112	if (!is_file($path))
14098	14113	{
14099		- throw new Exception(sprintf('File [%s] not found', $path), 404);
	14114	+ VBOHttpDocument::getInstance($app)->close(404, sprintf('File [%s] not found', $path));
14100	14115	}
14101	14116
14102		- jimport('joomla.filesystem.file');
	14117	+ /**
	14118	+ * Accept only non-traversal paths under the customer docs folder.
	14119	+ *
	14120	+ * @since 1.18.13 (J) - 1.8.13 (WP)
	14121	+ */
	14122	+ $path = realpath($path);
14103	14123
	14124	+ if (!$path || strpos($path, VBO_CUSTOMERS_PATH) !== 0)
	14125	+ {
	14126	+ VBOHttpDocument::getInstance($app)->close(403, 'Path not allowed for file deletion.');
	14127	+ }
	14128	+
14104	14129	$removed = JFile::delete($path);
14105	14130
14106		- echo json_encode(array('status' => (int) $removed));
14107		- exit;
	14131	+ VBOHttpDocument::getInstance($app)->json(array('status' => (int) $removed));
14108	14132	}
14109	14133
14110	14134	/**
14111	14135	* AJAX task to invoke a specific report and obtain information.