Merge branch 'security/opage' into develop

This commit is contained in:
Kijin Sung 2022-03-16 10:29:43 +09:00
commit 65dd68f9f3
8 changed files with 218 additions and 205 deletions

View file

@ -93,11 +93,16 @@ class TemplateHandler
{
// verify arguments
$tpl_path = trim(preg_replace('@^' . preg_quote(\RX_BASEDIR, '@') . '|\./@', '', str_replace('\\', '/', $tpl_path)), '/') . '/';
if($tpl_path === '/' || !is_dir($tpl_path))
if($tpl_path === '/')
{
$tpl_path = '';
}
elseif(!is_dir(\RX_BASEDIR . $tpl_path))
{
$this->resetState();
return;
}
if(!file_exists(\RX_BASEDIR . $tpl_path . $tpl_filename) && file_exists(\RX_BASEDIR . $tpl_path . $tpl_filename . '.html'))
{
$tpl_filename .= '.html';

View file

@ -15,10 +15,14 @@ $lang->page_type_name['ARTICLE'] = 'Article Page';
$lang->page_type_name['WIDGET'] = 'Widget Page';
$lang->page_type_name['OUTSIDE'] = 'External Page';
$lang->about_page_type = 'Select Page Type to build a page. <ol><li>Widget: Create multiple widgets.</li><li>Article: Create articles with titles, contents and tags for posting page. </li><li>External Page: Use external HTML or PHP files in Rhymix.</li></ol>';
$lang->opage_path = 'Location of External Document';
$lang->opage_path = 'Location of External Document for PC';
$lang->about_opage = 'This module enables to use external html or php files in Rhymix. It allows absolute or relative path, and if the url starts with \'http://\' , it can display the external page of the server.';
$lang->about_opage_path = 'Please enter the location of external document. Both absolute path such as \'/path1/path2/sample.php\' or relative path such as \'../path2/sample.php\' can be used. If you input the path like \'http://url/sample.php\', the result will be received and then displayed. This is current Rhymix\'s absolute path. ';
$lang->opage_mobile_path = 'Location of External Document for Mobile View';
$lang->opage_mobile_path = 'Location of External Document for Mobile';
$lang->about_opage_mobile_path = 'Please enter the location of external document for mobile view. If not inputted, it uses the external document specified above. Both absolute path such as \'/path1/path2/sample.php\' or relative path such as \'../path2/sample.php\' can be used. If you input the path like \'http://url/sample.php\', the result will be received and then displayed. This is current Rhymix\'s absolute path. ';
$lang->opage_postprocessing = 'Postprocessing';
$lang->about_opage_postprocessing = 'Parse and execute the external document as a PHP script and/or Rhymix template. This does not apply to URL paths.<br />Beware that executing untrusted sources can lead to security problems.';
$lang->opage_proc_php = 'Execute PHP code';
$lang->opage_proc_tpl = 'Parse as Rhymix template';
$lang->page_management = 'Manage of page';
$lang->page_delete_warning = 'If you delete a page, the files of the page will be removed also.';

View file

@ -15,11 +15,15 @@ $lang->page_type_name['ARTICLE'] = '문서 페이지';
$lang->page_type_name['WIDGET'] = '위젯 페이지';
$lang->page_type_name['OUTSIDE'] = '외부 페이지';
$lang->about_page_type = '페이지 타입을 선택하여 원하는 화면을 구성할 수 있습니다. <ol><li>위젯형 : 여러가지 위젯들을 생성하여 화면을 구성합니다.</li><li>문서형 : 제목, 내용, 태그를 갖는 문서를 제작하여 포스팅 형식의 페이지를 작성합니다. </li><li>외부페이지형 : 외부 HTML 또는 PHP 파일을 Rhymix에서 사용할 수 있습니다.</li></ol>';
$lang->opage_path = '외부 문서 위치';
$lang->about_opage = 'Rhymix가 아닌 외부 HTML 또는 PHP 파일을 삽입할 수 있습니다. 절대경로, 상대경로를 이용할 수 있으며 http:// 로 시작할 경우 서버 외부의 페이지도 표시할 수 있습니다';
$lang->opage_path = 'PC용 외부 문서 위치';
$lang->about_opage = 'Rhymix가 아닌 외부 HTML 또는 PHP 파일을 삽입할 수 있습니다. 절대경로, 상대경로를 이용할 수 있으며 http:// 또는 https://로 시작할 경우 서버 외부의 페이지도 표시할 수 있습니다';
$lang->about_opage_path = '외부문서의 위치를 입력해주세요. /path1/path2/sample.php 와 같이 절대경로나 ../path2/sample.php와 같은 상대경로 모두 사용가능합니다. http://url/sample.php 와 같이 사용하면 해당 페이지를 웹으로 전송 받아 출력 하게 됩니다. 현재 Rhymix가 설치된 절대경로는 다음과 같습니다. ';
$lang->opage_mobile_path = '모바일용 외부 문서 위치';
$lang->about_opage_mobile_path = '모바일용 외부문서의 위치를 입력해주세요. 입력하지 않으면 위에서 지정한 외부문서 위치의 페이지를 이용합니다. /path1/path2/sample.php 와 같이 절대경로나 ../path2/sample.php와 같은 상대경로 모두 사용가능합니다. http://url/sample.php 와 같이 사용하면 해당 페이지를 웹으로 전송 받아 출력 하게 됩니다. 현재 Rhymix가 설치된 절대경로는 다음과 같습니다. ';
$lang->opage_postprocessing = '외부 문서 후처리';
$lang->about_opage_postprocessing = '외부 문서의 내용을 PHP 및 Rhymix 템플릿 문법에 따라 해석하도록 할 수 있습니다. http:// 또는 https://로 시작하는 외부 페이지에는 적용되지 않습니다.<br />신뢰할 수 없는 문서를 실행할 경우 보안상 위협의 될 수 있으니 주의하십시오.';
$lang->opage_proc_php = 'PHP 코드 실행';
$lang->opage_proc_tpl = '템플릿 해석';
$lang->page_management = '페이지 관리';
$lang->page_delete_warning = '페이지를 삭제할 때 파일도 함께 삭제합니다';
$lang->msg_not_selected_page = '선택한 페이지가 없습니다.';

View file

@ -28,6 +28,12 @@ class pageAdminController extends page
$args->mid = $args->page_name; //because if mid is empty in context, set start page mid
$args->path = (!$args->path) ? '' : $args->path;
$args->mpath = (!$args->mpath) ? '' : $args->mpath;
$args->opage_proc_php = $args->opage_proc_php ?? 'N';
$args->opage_proc_tpl = $args->opage_proc_tpl ?? 'N';
if ($args->opage_proc_tpl === 'Y')
{
$args->opage_proc_php = 'Y';
}
unset($args->page_name);
if($args->use_mobile != 'Y') $args->use_mobile = '';

View file

@ -3,96 +3,6 @@
class pageMobile extends pageView
{
function init()
{
switch($this->module_info->page_type)
{
case 'WIDGET' :
{
$this->cache_file = sprintf("%sfiles/cache/page/%d.%s.%s.m.cache.php", RX_BASEDIR, $this->module_info->module_srl, Context::getLangType(), Context::getSslStatus());
$this->interval = (int)($this->module_info->page_caching_interval);
break;
}
case 'OUTSIDE' :
{
$this->cache_file = sprintf("./files/cache/opage/%d.%s.m.cache.php", $this->module_info->module_srl, Context::getSslStatus());
$this->interval = (int)($this->module_info->page_caching_interval);
$this->path = $this->module_info->mpath ?: $this->module_info->path;
break;
}
}
}
function dispPageIndex()
{
// Variables used in the template Context:: set()
if($this->module_srl) Context::set('module_srl',$this->module_srl);
$page_type_name = strtolower($this->module_info->page_type);
$method = '_get' . ucfirst($page_type_name) . 'Content';
if (method_exists($this, $method))
{
$page_content = $this->{$method}();
}
else
{
throw new Rhymix\Framework\Exception(sprintf('%s method is not exists', $method));
}
Context::set('module_info', $this->module_info);
Context::set('page_content', $page_content);
$this->setTemplatePath($this->module_path . 'tpl');
$this->setTemplateFile('mobile');
}
function _getWidgetContent()
{
// Arrange a widget ryeolro
if($this->module_info->mcontent)
{
$cache_file = sprintf("%sfiles/cache/page/%d.%s.m.cache.php", RX_BASEDIR, $this->module_info->module_srl, Context::getLangType());
$interval = (int)($this->module_info->page_caching_interval);
if($interval>0)
{
if(!file_exists($cache_file) || filesize($cache_file) < 1)
{
$mtime = 0;
}
else
{
$mtime = filemtime($cache_file);
}
if($mtime + $interval*60 > $_SERVER['REQUEST_TIME'])
{
$page_content = FileHandler::readFile($cache_file);
$page_content = str_replace('<!--#Meta:', '<!--Meta:', $page_content);
}
else
{
$oWidgetController = getController('widget');
$page_content = $oWidgetController->transWidgetCode($this->module_info->mcontent);
FileHandler::writeFile($cache_file, $page_content);
}
}
else
{
if(file_exists($cache_file))
{
FileHandler::removeFile($cache_file);
}
$page_content = $this->module_info->mcontent;
}
}
else
{
$page_content = $this->module_info->content;
}
return $page_content;
}
function _getArticleContent()
{
$oTemplate = &TemplateHandler::getInstance();
@ -135,18 +45,6 @@ class pageMobile extends pageView
return $page_content;
}
function _getOutsideContent()
{
// check if it is http or internal file
if($this->path)
{
if(preg_match("/^([a-z]+):\/\//i",$this->path)) $content = $this->getHtmlPage($this->path, $this->interval, $this->cache_file);
else $content = $this->executeFile($this->path, $this->interval, $this->cache_file);
}
return $content;
}
}
/* End of file page.mobile.php */
/* Location: ./modules/page/page.mobile.php */

View file

@ -7,33 +7,46 @@
*/
class pageView extends page
{
var $module_srl = 0;
var $list_count = 20;
var $page_count = 10;
var $cache_file;
var $interval;
var $path;
public $module_srl = 0;
public $list_count = 20;
public $page_count = 10;
public $cache_file = null;
public $interval = 0;
public $path = '';
public $proc_php = false;
public $proc_tpl = false;
/**
* @brief Initialization
*/
function init()
{
switch($this->module_info->page_type)
if ($this->module_info->page_type === 'WIDGET')
{
case 'WIDGET' :
{
$this->cache_file = sprintf("%sfiles/cache/page/%d.%s.%s.cache.php", RX_BASEDIR, $this->module_info->module_srl, Context::getLangType(), Context::getSslStatus());
$this->interval = (int)($this->module_info->page_caching_interval ?? 0);
break;
}
case 'OUTSIDE' :
{
$this->cache_file = sprintf("%sfiles/cache/opage/%d.%s.cache.php", RX_BASEDIR, $this->module_info->module_srl, Context::getSslStatus());
$this->interval = (int)($this->module_info->page_caching_interval ?? 0);
$this->path = $this->module_info->path;
break;
}
$this->interval = (int)($this->module_info->page_caching_interval ?? 0);
$this->cache_file = vsprintf('%sfiles/cache/page/%d.%s.%s.%s.cache.php', [
\RX_BASEDIR,
$this->module_info->module_srl,
Context::getLangType(),
Context::getSslStatus(),
$this instanceof pageMobile ? 'm' : 'pc',
]);
}
if ($this->module_info->page_type === 'OUTSIDE')
{
$this->interval = (int)($this->module_info->page_caching_interval ?? 0);
$this->path = $this->module_info->path ?? '';
$this->proc_php = (isset($this->module_info->opage_proc_php) && $this->module_info->opage_proc_php === 'N') ? false : true;
$this->proc_tpl = (isset($this->module_info->opage_proc_tpl) && $this->module_info->opage_proc_tpl === 'Y') ? true : false;
$this->cache_file = vsprintf('%sfiles/cache/opage/%d.%s.%s.%s.%s.cache.php', [
\RX_BASEDIR,
$this->module_info->module_srl,
Context::getSslStatus(),
$this->proc_php ? 'php' : 'nophp',
$this->proc_tpl ? 'tpl' : 'notpl',
$this instanceof pageMobile ? 'm' : 'pc',
]);
}
}
@ -43,50 +56,78 @@ class pageView extends page
function dispPageIndex()
{
// Variables used in the template Context:: set()
if($this->module_srl) Context::set('module_srl',$this->module_srl);
if ($this->module_srl)
{
Context::set('module_srl', $this->module_srl);
}
// Kick out anyone who tries to exploit RVE-2022-2.
foreach (Context::getRequestVars() as $key => $val)
{
if (preg_match('/[\{\}\(\)<>\$\'"]/', $key) || preg_match('/[\{\}\(\)<>\$\'"]/', $val))
{
throw new Rhymix\Framework\Exceptions\SecurityViolation();
}
}
// Get page content according to page type.
$page_type_name = strtolower($this->module_info->page_type);
if (!in_array($page_type_name, ['widget', 'article', 'outside']))
{
$page_type_name = 'widget';
}
$method = '_get' . ucfirst($page_type_name) . 'Content';
if(method_exists($this, $method))
{
$page_content = $this->{$method}();
}
else
{
throw new Rhymix\Framework\Exception(sprintf('%s method is not exists', $method));
}
$page_content = $this->{$method}();
Context::set('module_info', $this->module_info);
Context::set('page_content', $page_content);
$this->setTemplatePath($this->module_path . 'tpl');
$this->setTemplateFile('content');
$this->setTemplateFile($this instanceof pageMobile ? 'mobile' : 'content');
}
function _getWidgetContent()
{
if($this->interval>0)
if ($this instanceof pageMobile)
{
if(!file_exists($this->cache_file)) $mtime = 0;
else $mtime = filemtime($this->cache_file);
$page_content = $this->module_info->mcontent ?: $this->module_info->content;
}
else
{
$page_content = $this->module_info->content;
}
if ($this->interval > 0)
{
if (!file_exists($this->cache_file) || !filesize($this->cache_file))
{
$mtime = 0;
}
else
{
$mtime = filemtime($this->cache_file);
}
if($mtime + $this->interval*60 > $_SERVER['REQUEST_TIME'])
if($mtime && $mtime + ($this->interval * 60) > \RX_TIME)
{
$page_content = FileHandler::readFile($this->cache_file);
$page_content = str_replace('<!--#Meta:', '<!--Meta:', $page_content);
}
else
{
$oWidgetController = getController('widget');
$page_content = $oWidgetController->transWidgetCode($this->module_info->content);
$oWidgetController = WidgetController::getInstance();
$page_content = $oWidgetController->transWidgetCode($page_content);
FileHandler::writeFile($this->cache_file, $page_content);
}
}
else
{
if(file_exists($this->cache_file)) FileHandler::removeFile($this->cache_file);
$page_content = $this->module_info->content;
if (file_exists($this->cache_file))
{
FileHandler::removeFile($this->cache_file);
}
}
return $page_content;
}
@ -113,14 +154,23 @@ class pageView extends page
function _getOutsideContent()
{
// check if it is http or internal file
if($this->path)
// Stop if the path is not set.
if (!$this->path)
{
if(preg_match("/^([a-z]+):\/\//i",$this->path)) $content = $this->getHtmlPage($this->path, $this->interval, $this->cache_file);
else $content = $this->executeFile($this->path, $this->interval, $this->cache_file);
return;
}
// External URL
if (preg_match('!^[a-z]+://!i', $this->path))
{
return $this->getHtmlPage($this->path, $this->interval, $this->cache_file);
}
// Internal PHP document
else
{
return $this->executeFile($this->path, $this->interval, $this->cache_file);
}
return $content;
}
/**
@ -138,8 +188,10 @@ class pageView extends page
FileHandler::getRemoteFile($path, $cache_file);
$content = FileHandler::readFile($cache_file);
}
// Create opage controller
$oPageController = getController('page');
// change url of image, css, javascript and so on if the page is from external server
$content = $oPageController->replaceSrc($content, $path);
@ -148,12 +200,15 @@ class pageView extends page
$buff->content = $content;
$buff = Context::convertEncoding($buff);
$content = $buff->content;
// Extract a title
$title = $oPageController->getTitle($content);
if($title) Context::setBrowserTitle($title);
// Extract header script
$head_script = $oPageController->getHeadScript($content);
if($head_script) Context::addHtmlHeader($head_script);
// Extract content from the body
$body_script = $oPageController->getBodyScript($content);
if(!$body_script) $body_script = $content;
@ -167,79 +222,96 @@ class pageView extends page
function executeFile($target_file, $caching_interval, $cache_file)
{
// Cancel if the file doesn't exist
if(!file_exists(FileHandler::getRealPath($target_file))) return;
// Get a path and filename
$tmp_path = explode('/',$cache_file);
$filename = $tmp_path[count($tmp_path)-1];
$filepath = preg_replace('/'.$filename."$/i","",$cache_file);
$cache_file = FileHandler::getRealPath($cache_file);
$level = ob_get_level();
// Verify cache
if($caching_interval <1 || !file_exists($cache_file) || filemtime($cache_file) + $caching_interval*60 <= $_SERVER['REQUEST_TIME'] || filemtime($cache_file)<filemtime($target_file))
$real_target_file = FileHandler::getRealPath($target_file);
if (!file_exists($real_target_file))
{
if(file_exists($cache_file)) FileHandler::removeFile($cache_file);
return;
}
// Read a target file and get content
// Return content from cache if available.
if ($caching_interval > 0 && file_exists($cache_file) && filemtime($cache_file) + ($caching_interval * 60) > \RX_TIME && filemtime($cache_file) > filemtime($real_target_file))
{
return file_get_contents($cache_file);
}
// Parse as template if enabled.
if ($this->proc_tpl)
{
// Store compiled template in a temporary file.
$oTemplate = TemplateHandler::getInstance();
$real_target_dir = dirname($real_target_file);
$tmp_cache_file = preg_replace('/\.cache\.php$/', '.compiled.php', $cache_file);
$content = $oTemplate->compileDirect($real_target_dir . '/', basename($real_target_file));
$success = Rhymix\Framework\Storage::write($tmp_cache_file, $content);
if (!$success)
{
return '';
}
// Include template file in an isolated scope.
$content = '';
$include_path = get_include_path();
$ob_level = ob_get_level();
ob_start();
include(FileHandler::getRealPath($target_file));
set_include_path($real_target_dir . PATH_SEPARATOR . $include_path);
call_user_func(function() use($real_target_dir, $tmp_cache_file) {
$__Context = Context::getAll();
$__Context->tpl_path = $real_target_dir;
global $lang;
include $tmp_cache_file;
});
set_include_path($include_path);
while (ob_get_level() > $ob_level)
{
$content .= ob_get_clean();
}
// Insert comments for debugging.
if(Rhymix\Framework\Debug::isEnabledForCurrentUser() && Context::getResponseMethod() === 'HTML' && !starts_with('<!DOCTYPE', $content) && !starts_with('<?xml', $content))
{
$sign = PHP_EOL . '<!-- Template %s : ' . $target_file . ' -->' . PHP_EOL;
$content = sprintf($sign, 'start') . $content . sprintf($sign, 'end');
}
}
// Parse as PHP if enabled.
elseif ($this->proc_php)
{
ob_start();
call_user_func(function() use($real_target_file) {
include $real_target_file;
});
$content = ob_get_clean();
// Replace relative path to the absolute path
$this->path = str_replace('\\', '/', realpath(dirname($target_file))) . '/';
$content = preg_replace_callback('/(target=|src=|href=|url\()("|\')?([^"\'\)]+)("|\'\))?/is',array($this,'_replacePath'),$content);
$content = preg_replace_callback('/(<!--%import\()(\")([^"]+)(\")/is',array($this,'_replacePath'),$content);
FileHandler::writeFile($cache_file, $content);
// Include and then Return the result
if(!file_exists($cache_file)) return;
// Attempt to compile
$oTemplate = &TemplateHandler::getInstance();
$script = $oTemplate->compileDirect($filepath, $filename);
FileHandler::writeFile($cache_file, $script);
}
// Import Context and lang as local variables.
$__Context = &$GLOBALS['__Context__'];
$__Context->tpl_path = $filepath;
global $lang;
// Start the output buffer.
$__ob_level_before_fetch = ob_get_level();
ob_start();
// Include the compiled template.
include $cache_file;
// Fetch contents of the output buffer until the buffer level is the same as before.
$contents = '';
while (ob_get_level() > $__ob_level_before_fetch)
// Otherwise, get the raw content of the file.
else
{
$contents .= ob_get_clean();
$content = file_get_contents($real_target_file);
}
// Insert template path comment tag.
if(Rhymix\Framework\Debug::isEnabledForCurrentUser() && Context::getResponseMethod() === 'HTML' && !starts_with('<!DOCTYPE', $contents) && !starts_with('<?xml', $contents))
{
$sign = PHP_EOL . '<!-- Template %s : ' . $target_file . ' -->' . PHP_EOL;
$contents = sprintf($sign, 'start') . $contents . sprintf($sign, 'end');
}
return $contents;
// Convert relative paths to absolute paths.
$this->path = str_replace('\\', '/', dirname($real_target_file)) . '/';
$content = preg_replace_callback('/\b(target=|src=|href=|url\()("|\')?([^"\'\)]+)("|\'\))?/is', array($this, '_replacePath'), $content);
$content = preg_replace_callback('/(<!--%import\()(\")([^"]+)(\")/is', array($this, '_replacePath'), $content);
// Write cache file.
$success = Rhymix\Framework\Storage::write($cache_file, $content);
return $content;
}
function _replacePath($matches)
{
$val = trim($matches[3]);
// Pass if the path is external or starts with /, #, { characters
// /=absolute path, #=hash in a page, {=Template syntax
if(strpos($val, '.') === FALSE || preg_match('@^((?:http|https|ftp|telnet|mms)://|(?:mailto|javascript):|[/#{])@i',$val))
{
return $matches[0];
// In case of .. , get a path
return $matches[0];
}
else if(strncasecmp('..', $val, 2) === 0)
// In case of .. , get a path
elseif(strncasecmp('..', $val, 2) === 0)
{
$p = Context::pathToUrl($this->path);
return sprintf("%s%s%s%s",$matches[1],$matches[2],$p.$val,$matches[4]);

View file

@ -121,4 +121,14 @@ function doCartSetup(url) {
jQuery(function($){
$('#pageBtnArea').delay(1000).show(1);
$('#opage_proc_php').on('change', function() {
if (!$(this).prop('checked')) {
$('#opage_proc_tpl').prop('checked', false);
}
});
$('#opage_proc_tpl').on('change', function() {
if ($(this).prop('checked')) {
$('#opage_proc_php').prop('checked', true);
}
});
});

View file

@ -99,6 +99,20 @@
<p class="x_help-block" id="aboutOpageMobilePath">{$lang->about_opage_mobile_path}<b>{realpath("./")}</b></p>
</div>
</div>
<div class="x_control-group" cond="$module_info->page_type == 'OUTSIDE'">
<label class="x_control-label">{$lang->opage_postprocessing}</label>
<div class="x_controls">
<label for="opage_proc_php" class="x_inline">
<input type="checkbox" name="opage_proc_php" id="opage_proc_php" value="Y" checked="checked"|cond="($module_info->opage_proc_php ?? 'Y') === 'Y'" />
{$lang->opage_proc_php}
</label>
<label for="opage_proc_tpl" class="x_inline">
<input type="checkbox" name="opage_proc_tpl" id="opage_proc_tpl" value="Y" checked="checked"|cond="($module_info->opage_proc_tpl ?? 'N') === 'Y'" />
{$lang->opage_proc_tpl}
</label>
<p class="x_help-block">{$lang->about_opage_postprocessing}</p>
</div>
</div>
<div class="x_control-group" cond="$module_info->page_type == 'ARTICLE'">
<label class="x_control-label" for="skin">{$lang->skin}</label>
<div class="x_controls">