[#32076] - Add path filter to joomla updates download process for the temp folder
- Fixed in Code Base
- 3 Feb 2021
- Medium
- Build: staging
- # 32076
- Diff
- zero-24:path
User tests: Successful: Unsuccessful:
Summary of Changes
The JSST has been contacted about an missing path filter whithin the joomla download process. Given that an successfull attack requires a Super User access to change the tmp path setting and also to trigger the update itself the JSST decided to move this patch to the public tracker.
Testing Instructions
- apply the patch
- Try to install an update or to "reinstall the core files"
- Make sure the update works as expected
- try to install an update via this custom update server (https://ci.joomla.org/artifacts/joomla/joomla-cms/staging/32076/downloads/39782/pr_list.xml)
Actual result BEFORE applying this Pull Request
The upgrade works as expected
Expected result AFTER applying this Pull Request
The upgrade works as expected
Documentation Changes Required
none
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_joomlaupdate |
Right even better
| Labels |
Added:
?
|
||
This has to wait for the archive package to be merged and the path filter patched as noted above. The package i mean is the one generated by drone.
| Category | Administration com_joomlaupdate | ⇒ | Administration com_joomlaupdate Libraries |
Test on Linux was ok, but on Windows it was failing. See joomla-framework/filter#40 for the fix in the framework package.
I have just merged the filter package and updated the branch here so this is ready to be tested again.
I've updated in the description the link to the update package for this PR so it points to the latest build.
I've updated in the description the link to the update package for this PR so it points to the latest build.
Thanks was about to do that too as we have to wait for it to be generated
I had to do it again because I had to restart drone.
I have tested this item
Tested with 2 server environments, one Linux with PHP 7.3, and one Windows with PHP 7.4.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32076.
I have tested this item
Tested on win10, with php8, following the testing instructions
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32076.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/32076.
@zero-24 Could you check @Quy 's suggestion above and fix it? #32076 (comment) . It will not change RTC status.
| Labels |
Added:
?
|
||
@zero-24 Could you check @Quy 's suggestion above and fix it? #32076 (comment) . It will not change RTC status.
Moved with: ce05326
Previous tests are still valid since last change after tests was code style only. I've restored the test results in the tracker.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-02-03 11:18:50 |
| Closed_By | ⇒ | HLeithner |
Thanks
You can then replace the whole switch statement with
$result = parent::clean($source, $type);