diff --git a/e107_admin/admin.php b/e107_admin/admin.php
index 426f7449d..d9fce75d1 100644
--- a/e107_admin/admin.php
+++ b/e107_admin/admin.php
@@ -127,32 +127,8 @@ class admin_start
}
// Files that can cause comflicts and problems.
- $this->deprecated = array(
- e_ADMIN."ad_links.php",
- e_PLUGIN."tinymce4/e_meta.php",
- e_THEME."bootstrap3/css/bootstrap_dark.css",
- e_PLUGIN."search_menu/languages/English.php",
- e_LANGUAGEDIR.e_LANGUAGE."/lan_parser_functions.php",
- e_LANGUAGEDIR.e_LANGUAGE."/admin/help/theme.php",
- e_HANDLER."np_class.php",
- e_CORE."shortcodes/single/user_extended.sc",
- e_ADMIN."download.php",
- e_PLUGIN."banner/config.php",
- e_PLUGIN."forum/newforumposts_menu_config.php",
- e_PLUGIN."forum/e_latest.php",
- e_PLUGIN."forum/e_status.php",
- e_PLUGIN."forum/forum_post_shortcodes.php",
- e_PLUGIN."forum/forum_shortcodes.php",
- e_PLUGIN."forum/forum_update_check.php",
- e_PLUGIN."online_extended_menu/online_extended_menu.php",
- e_PLUGIN."online_extended_menu/images/user.png",
- e_PLUGIN."online_extended_menu/languages/English.php",
- e_PLUGIN."pm/sendpm.sc",
- e_PLUGIN."pm/shortcodes/",
- e_PLUGIN."social/e_header.php",
- // e_PLUGIN."download/url/url.php", // removed by download_setup.php
- // e_PLUGIN."download/url/sef_url.php",
- );
+ $fileInspector = e107::getFileInspector();
+ $this->deprecated = $fileInspector->insecureFiles;
$this->checkCoreVersion();
diff --git a/e107_admin/fileinspector.php b/e107_admin/fileinspector.php
index 5ef87fcee..f6f8a0598 100755
--- a/e107_admin/fileinspector.php
+++ b/e107_admin/fileinspector.php
@@ -685,14 +685,14 @@ class file_inspector {
{
if ($validationCode & e_file_inspector::VALIDATED)
return 'check';
+ if (!($validationCode & e_file_inspector::VALIDATED_FILE_EXISTS))
+ return 'missing';
+ if (!($validationCode & e_file_inspector::VALIDATED_FILE_SECURITY))
+ return 'warning';
if (!($validationCode & e_file_inspector::VALIDATED_PATH_KNOWN))
return 'unknown';
if (!($validationCode & e_file_inspector::VALIDATED_PATH_VERSION))
return 'old';
- if (!($validationCode & e_file_inspector::VALIDATED_FILE_SECURITY))
- return 'warning';
- if (!($validationCode & e_file_inspector::VALIDATED_FILE_EXISTS))
- return 'missing';
if (!($validationCode & e_file_inspector::VALIDATED_HASH_CALCULABLE))
return 'uncalc';
if (!($validationCode & e_file_inspector::VALIDATED_HASH_CURRENT))
@@ -1004,6 +1004,8 @@ class file_inspector {
ksort($this->files);
foreach ($this->files as $relativePath => $validation)
{
+ if (!$this->displayAllowed($validation)) continue;
+
list($icon, $title) = $this->getGlyphForValidationCode($validation);
$text .= '
';
$text .= "$icon ";
diff --git a/e107_handlers/e_file_inspector.php b/e107_handlers/e_file_inspector.php
index 848124761..98fce7c97 100644
--- a/e107_handlers/e_file_inspector.php
+++ b/e107_handlers/e_file_inspector.php
@@ -24,6 +24,35 @@ abstract class e_file_inspector implements e_file_inspector_interface
protected $customDirsCache;
private $undeterminable = array();
+ // FIXME: Better place for the insecure file list
+ public $insecureFiles = [
+ e_ADMIN . "ad_links.php",
+ e_PLUGIN . "tinymce4/e_meta.php",
+ e_THEME . "bootstrap3/css/bootstrap_dark.css",
+ e_PLUGIN . "search_menu/languages/English.php",
+ e_LANGUAGEDIR . e_LANGUAGE . "/lan_parser_functions.php",
+ e_LANGUAGEDIR . e_LANGUAGE . "/admin/help/theme.php",
+ e_HANDLER . "np_class.php",
+ e_CORE . "shortcodes/single/user_extended.sc",
+ e_ADMIN . "download.php",
+ e_PLUGIN . "banner/config.php",
+ e_PLUGIN . "forum/newforumposts_menu_config.php",
+ e_PLUGIN . "forum/e_latest.php",
+ e_PLUGIN . "forum/e_status.php",
+ e_PLUGIN . "forum/forum_post_shortcodes.php",
+ e_PLUGIN . "forum/forum_shortcodes.php",
+ e_PLUGIN . "forum/forum_update_check.php",
+ e_PLUGIN . "online_extended_menu/online_extended_menu.php",
+ e_PLUGIN . "online_extended_menu/images/user.png",
+ e_PLUGIN . "online_extended_menu/languages/English.php",
+ e_PLUGIN . "pm/sendpm.sc",
+ e_PLUGIN . "pm/shortcodes/",
+ e_PLUGIN . "social/e_header.php",
+ ];
+
+ private $existingInsecureFiles = array();
+ private $existingInsecureDirectories = array();
+
/**
* e_file_inspector constructor
* @param string $database The database from which integrity data may be read or to which integrity data may be
@@ -43,6 +72,16 @@ abstract class e_file_inspector implements e_file_inspector_interface
$appRoot . e107::getFolder('admin') . "core_image.php",
]
);
+ $this->existingInsecureFiles = array_filter($this->insecureFiles, function ($path)
+ {
+ return is_file($path);
+ });
+ $this->existingInsecureFiles = array_map('realpath', $this->existingInsecureFiles);
+ $this->existingInsecureDirectories = array_filter($this->insecureFiles, function ($path)
+ {
+ return is_dir($path);
+ });
+ $this->existingInsecureDirectories = array_map('realpath', $this->existingInsecureDirectories);
}
/**
@@ -68,7 +107,7 @@ abstract class e_file_inspector implements e_file_inspector_interface
if ($version === null) $version = $this->getCurrentVersion();
$bits = 0x0;
- $absolutePath = realpath(e_BASE . $path);
+ $absolutePath = $this->relativePathToAbsolutePath($path);
$dbChecksums = $this->getChecksums($path);
$dbChecksum = $this->getChecksum($path, $version);
$actualChecksum = !empty($dbChecksums) ? $this->checksumPath($absolutePath) : null;
@@ -174,7 +213,13 @@ abstract class e_file_inspector implements e_file_inspector_interface
*/
public function isInsecure($path)
{
- # TODO
+ $absolutePath = $this->relativePathToAbsolutePath($path);
+ if (in_array($absolutePath, $this->existingInsecureFiles)) return true;
+ foreach ($this->existingInsecureDirectories as $existingInsecureDirectory)
+ {
+ $existingInsecureDirectory .= '/';
+ if (substr($absolutePath, 0, strlen($existingInsecureDirectory)) === $existingInsecureDirectory) return true;
+ }
return false;
}
@@ -244,4 +289,13 @@ abstract class e_file_inspector implements e_file_inspector_interface
$customDirs = e107::getInstance()->e107_dirs ? e107::getInstance()->e107_dirs : [];
$this->customDirsCache = array_diff_assoc($customDirs, $this->defaultDirsCache);
}
+
+ /**
+ * @param $path
+ * @return false|string
+ */
+ private function relativePathToAbsolutePath($path)
+ {
+ return realpath(e_BASE . $path);
+ }
}
\ No newline at end of file
|