Avoid directory traversal when reading package xml files, also check if file exists before try to read it

1 files changed, 6 insertions, 1 deletions

diff --git a/usr/local/www/pkg_edit.php b/usr/local/www/pkg_edit.php
index 792ac43..9fb48fc 100644
--- a/usr/local/www/pkg_edit.php
+++ b/usr/local/www/pkg_edit.php
@@ -65,9 +65,14 @@ function domTT_title($title_msg){
 $xml = htmlspecialchars($_GET['xml']);
 if($_POST['xml']) $xml = htmlspecialchars($_POST['xml']);
 
-if($xml == "") {
+$xml = basename($xml);
+
+if ($xml == "") {
             print_info_box_np(gettext("ERROR: No package defined."));
             die;
+} else if (!file_exists('/usr/local/pkg/' . $xml)) {
+            print_info_box_np(gettext("ERROR: XML file not found"));
+            die;
 } else {
             $pkg = parse_xml_config_pkg("/usr/local/pkg/" . $xml, "packagegui");
 }