QA: Further hardening of External Links

Attribution: Aleksey Solovev (Positive Technologies) Advisory forthcoming.
Cacti · Nov 22, 2023 · a2af4f8 · a2af4f8
1 parent 261adbc
commit a2af4f8
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/link.php b/link.php
@@ -77,10 +77,11 @@
 		} else {
 			print '<div id="content">';
 
-			$file = CACTI_PATH_INCLUDE . '/content/' . basename($page['contentfile']);
+			$basepath = CACTI_PATH_INCLUDE . '/content';
+			$file     = realpath($basepath . '/' . $page['contentfile']);
 
-			if (file_exists($file)) {
-				include_once($file);
+			if ($file !== false && substr($file, 0, strlen($basepath)) == $basepath) {
+				print file_get_contents($file);
 			} else {
 				print '<h1>The file \'' . html_escape($page['contentfile']) . '\' does not exist!!</h1>';
 			}