diff --git a/web/includes/functions.php b/web/includes/functions.php index 77cd1ca47..c5c17e17d 100644 --- a/web/includes/functions.php +++ b/web/includes/functions.php @@ -55,6 +55,7 @@ function CSPHeaders($view, $nonce) { case 'log': case 'logout': case 'options': + case 'plugin': case 'privacy': case 'storage': case 'version': { diff --git a/web/skins/classic/views/plugin.php b/web/skins/classic/views/plugin.php index 7b4cf85ca..4f3b4ccf2 100644 --- a/web/skins/classic/views/plugin.php +++ b/web/skins/classic/views/plugin.php @@ -36,7 +36,8 @@ if ( $zid > 0 ) { return; } $monitor = dbFetchMonitor ( $mid ); -$plugin = $_REQUEST['pl']; +// Only allow certain filename characters (not including a period) to prevent directory traversal. +$plugin = preg_replace('/[^-a-zA-Z0-9]/', '', $_REQUEST['pl']); $plugin_path = dirname(ZM_PLUGINS_CONFIG_PATH)."/".$plugin; @@ -103,7 +104,7 @@ function pLang($name)
@@ -111,7 +112,7 @@ function pLang($name) - +
@@ -143,8 +144,9 @@ foreach($pluginOptions as $name => $popt) - + + $popt) ?>
- disabled="disabled"/> + disabled="disabled"/>