From 4b9434bf1ba4c015da11309602cfccf1a9c2493c Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Wed, 21 Jan 2015 00:16:42 +0100 Subject: [PATCH] [ticket/13531] Explicitly disallow trailing paths (e.g. PATH_INFO). PHPBB3-13531 --- phpBB/includes/startup.php | 34 +++++++++++++++++ tests/security/trailing_path_test.php | 55 +++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 tests/security/trailing_path_test.php diff --git a/phpBB/includes/startup.php b/phpBB/includes/startup.php index 2f3b1c5324..d9dab2a356 100644 --- a/phpBB/includes/startup.php +++ b/phpBB/includes/startup.php @@ -95,6 +95,40 @@ function deregister_globals() unset($input); } +/** + * Check if requested page uses a trailing path + * + * @param string $phpEx PHP extension + * + * @return bool True if trailing path is used, false if not + */ +function phpbb_has_trailing_path($phpEx) +{ + // Check if path_info is being used + if (!empty($_SERVER['PATH_INFO']) || !empty($_SERVER['ORIG_PATH_INFO'])) + { + return true; + } + + // Match any trailing path appended to a php script in the REQUEST_URI. + // It is assumed that only actual PHP scripts use names like foo.php. Due + // to this, any phpBB board inside a directory that has the php extension + // appended to its name will stop working, i.e. if the board is at + // example.com/phpBB/test.php/ or example.com/test.php/ + if (preg_match('#^[^?]+\.' . preg_quote($phpEx, '#') . '/#', $_SERVER['REQUEST_URI'])) + { + return true; + } + + return false; +} + +// Check if trailing path is used +if (phpbb_has_trailing_path($phpEx)) +{ + exit('Trailing paths and path_info is not supported by phpBB 3.0'); +} + // Register globals and magic quotes have been dropped in PHP 5.4 if (version_compare(PHP_VERSION, '5.4.0-dev', '>=')) { diff --git a/tests/security/trailing_path_test.php b/tests/security/trailing_path_test.php new file mode 100644 index 0000000000..72ec6b8816 --- /dev/null +++ b/tests/security/trailing_path_test.php @@ -0,0 +1,55 @@ +assertSame($expected, phpbb_has_trailing_path($phpEx)); + } +}