Avoid Full Path Disclosure error on session error. #306
Conversation
| @@ -82,6 +69,23 @@ | |||
| exit; | |||
| } | |||
|
|
|||
| // Force cookie path (but do not change lifetime) | |||
There was a problem hiding this comment.
could this code section be cleaned up (indentation + comments)?
|
@Knah-Tsaeb @TeamAlexandriZ could you test this PR and give us some feedback? :) |
|
Give me a patched online target and I'll looking around. (with server error enabled for test this patch) |
ArthurHoaro
force-pushed
the
fpd
branch
2 times, most recently
from
167a0fa to
6d0e5a3
Compare
* Add a function to validate session ID. * Generate a new session ID if an invalid token is passed.
|
@TeamAlexandriZ Here you go: https://workspace.hoa.ro/shaarli-fpd/ |
|
Hi, it's OK for cookie but on this server all php file of the folder /tests give a full path disclosure to : Error found : Fatal error: require_once(): Failed opening required 'application/Utils.php' (include_path='.:/usr/share/pear:/usr/share/php') in /var/www/html/codiad/workspace/shaarli-fpd/tests/UtilsTest.php on line 6 |
|
@TeamAlexandriZ thanks for testing! @ArthurHoaro that's weird, there should be a |
|
I need to check but it might only be because I disallowed htaccess rules. |
|
Confirmed, with htaccess rules, those files return an error 403. |
|
Merge-ready then ;-) |
Avoid Full Path Disclosure error on session error.
|
On Nginx, the .htaccess doesn't work. |
|
@TeamAlexandriZ Nginx's configuration and philosophy are quite different from Apache's (and related to server configuration rather than to this particular PR) There is a wiki page dedicated to Server configuration which has sections for Apache2 and Nginx, and aims at providing Shaarli users with a sane, secure server setup -all improvements are welcome! |
|
Yes, but add location ^~ /tests/ { to your /etc/nginx/deny.conf wiki example because actually there are nothing that deny the access for Nginx users and the FPD is visible. |
Improves shaarli#306 Relates to shaarli#335 & shaarli#336 Issue: - the format of the value returned by `uniqid()` depends on PHP settings - the regex checking the session ID does not cover all cases Fix: - apply a hash function to the session ID (SHA1) See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function Signed-off-by: VirtualTam <[email protected]>
Improves shaarli#306 Relates to shaarli#335 & shaarli#336 Duplicated by shaarli#339 Issues: - PHP regenerates the session ID if it is not compliant - the regex checking the session ID does not cover all cases - different algorithms: md5, sha1, sha256, etc. - bit representations: 4, 5, 6 Fix: - regex: support all possible characters - '[a-zA-Z,-]{2,128}' - tests: add coverage for all algorithms & bit representations TODO: - remove `uniqid()` usage See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character - http://php.net/manual/en/function.session-id.php - http://php.net/manual/en/function.session-regenerate-id.php - http://php.net/manual/en/function.hash-algos.php Signed-off-by: VirtualTam <[email protected]>
Improves shaarli#306 Relates to shaarli#335 & shaarli#336 Duplicated by shaarli#339 Issues: - PHP regenerates the session ID if it is not compliant - the regex checking the session ID does not cover all cases - different algorithms: md5, sha1, sha256, etc. - bit representations: 4, 5, 6 Fix: - `index.php`: - remove `uniqid()` usage - call `session_regenerate_id()` if an invalid cookie is detected - regex: support all possible characters - '[a-zA-Z,-]{2,128}' - tests: add coverage for all algorithms & bit representations See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character - http://php.net/manual/en/function.session-id.php - http://php.net/manual/en/function.session-regenerate-id.php - http://php.net/manual/en/function.hash-algos.php Signed-off-by: VirtualTam <[email protected]>
Improves shaarli#306 Relates to shaarli#335 & shaarli#336 Duplicated by shaarli#339 Issues: - PHP regenerates the session ID if it is not compliant - the regex checking the session ID does not cover all cases - different algorithms: md5, sha1, sha256, etc. - bit representations: 4, 5, 6 Fix: - `index.php`: - remove `uniqid()` usage - call `session_regenerate_id()` if an invalid cookie is detected - regex: support all possible characters - '[a-zA-Z,-]{2,128}' - tests: add coverage for all algorithms & bit representations See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character - http://php.net/manual/en/function.session-id.php - http://php.net/manual/en/function.session-regenerate-id.php - http://php.net/manual/en/function.hash-algos.php Signed-off-by: VirtualTam <[email protected]>
Improves shaarli#306 Relates to shaarli#335 & shaarli#336 Duplicated by shaarli#339 Issues: - PHP regenerates the session ID if it is not compliant - the regex checking the session ID does not cover all cases - different algorithms: md5, sha1, sha256, etc. - bit representations: 4, 5, 6 Fix: - `index.php`: - remove `uniqid()` usage - call `session_regenerate_id()` if an invalid cookie is detected - regex: support all possible characters - '[a-zA-Z,-]{2,128}' - tests: add coverage for all algorithms & bit representations See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character - http://php.net/manual/en/function.session-id.php - http://php.net/manual/en/function.session-regenerate-id.php - http://php.net/manual/en/function.hash-algos.php Signed-off-by: VirtualTam <[email protected]>
related to #298
ping @TeamAlexandriZ