mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-21 18:25:02 -04:00
jekkos
47aade5024
* fix(locale): validate language_code against known locales to block path traversal postSaveLocale() stored language_code from user input with no allow-list validation, and it later flows into Language::setLocale()/load() where the locale segment is require()'d. An authenticated config-grant account could store a relative path (e.g. ../../public/uploads) and, combined with a planted file in public/uploads/, achieve unauthenticated RCE on the next request. Validate the submitted language against array_keys(get_languages()) before storing, and harden languageExists() to reject path separators and dot-dot sequences. Adds regression tests. * test(locale): give locale fixture valid reference-code min/max defaults * fix(locale): reject null bytes in languageExists guard A stored language_code containing a NUL byte passes the existing path-separator and parent-dir checks, then reaches file_exists(). On PHP 8.5+ file_exists() throws a ValueError for NUL-byte paths, which breaks configuration loading. Reject NUL bytes in the guard and add regression tests.
72 lines
1.9 KiB
PHP
72 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Events;
|
|
|
|
use App\Libraries\MY_Migration;
|
|
use App\Models\Appconfig;
|
|
use CodeIgniter\Session\Handlers\DatabaseHandler;
|
|
use CodeIgniter\Session\Handlers\FileHandler;
|
|
use CodeIgniter\Session\Session;
|
|
use Config\OSPOS;
|
|
use Config\Services;
|
|
|
|
/**
|
|
* @property my_migration migration;
|
|
* @property session session;
|
|
* @property appconfig appconfig;
|
|
* @property mixed $migration_config
|
|
* @property mixed $config
|
|
*/
|
|
class Load_config
|
|
{
|
|
public Session $session;
|
|
|
|
public function load_config(): void
|
|
{
|
|
$migration_config = config('Migrations');
|
|
$migration = new MY_Migration($migration_config);
|
|
|
|
$this->session = session();
|
|
|
|
$config = config(OSPOS::class);
|
|
|
|
if (!$migration->isLatest()) {
|
|
$this->session->destroy();
|
|
}
|
|
|
|
$this->setDefaultLanguage($config);
|
|
|
|
$language = Services::language();
|
|
$language->setLocale(current_language_code());
|
|
|
|
date_default_timezone_set($config->settings['timezone'] ?? ini_get('date.timezone'));
|
|
|
|
bcscale(max(2, totals_decimals() + tax_decimals()));
|
|
}
|
|
|
|
private function setDefaultLanguage(OSPOS $config): void
|
|
{
|
|
$languageCode = $config->settings['language_code'] ?? null;
|
|
|
|
if (empty($config->settings) || $languageCode === null) {
|
|
$config->settings['language'] = 'english';
|
|
$config->settings['language_code'] = 'en';
|
|
return;
|
|
}
|
|
|
|
if (!$this->languageExists($languageCode)) {
|
|
$config->settings['language'] = 'english';
|
|
$config->settings['language_code'] = 'en';
|
|
}
|
|
}
|
|
|
|
private function languageExists(string $languageCode): bool
|
|
{
|
|
if (strpbrk($languageCode, '/\\') !== false || str_contains($languageCode, '..') || str_contains($languageCode, "\0")) {
|
|
return false;
|
|
}
|
|
|
|
return file_exists(APPPATH . 'Language/' . $languageCode);
|
|
}
|
|
}
|