Skip to content

Commit 3d7fbaf

Browse files
ggoffyggoffy
committed
update common files / security.md
1 parent ad29f5f commit 3d7fbaf

12 files changed

Lines changed: 879 additions & 248 deletions

File tree

‎SECURITY.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# XOOPS Security Policy
2+
3+
XOOPS takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations.
4+
This documentation provides guidelines and standard procedures regarding maintaining security with our software.
5+
6+
## Supported Versions
7+
8+
By default, only the latest version built from branch `master` (or `main`) is supported with security updates.
9+
10+
11+
## Reporting a Vulnerability
12+
13+
**Please do not report security vulnerabilities through public GitHub issues.**
14+
15+
Instead, please report (suspected) security vulnerabilities to
16+
**[security@xoops.org](mailto:security@xoops.org)**. You will receive a response from
17+
us within 48 hours. If the issue is confirmed, we will release a patch as soon
18+
as possible depending on complexity, and you'll receive a credit in our changelog.
19+
20+
Please use a descriptive subject line for your report email. After the initial
21+
reply to your report, the security team will endeavor to keep you informed of
22+
the progress being made towards a fix and announcement.
23+
24+
In addition, please include the following information along with your report:
25+
26+
* Your name and affiliation (if any).
27+
* A description of the technical details of the vulnerabilities. It is very
28+
important to let us know how we can reproduce your findings.
29+
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
30+
* Full paths of source file(s) related to the manifestation of the issue
31+
* The location of the affected source code (tag/branch/commit or direct URL)
32+
* Any special configuration required to reproduce the issue
33+
* Step-by-step instructions to reproduce the issue
34+
* Proof-of-concept or exploit code (if possible)
35+
* Impact of the issue, including how an attacker might exploit the issue
36+
37+
This information will help us triage your report more quickly.

‎admin/index.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
// Uploads Folders Created
6363
foreach (\array_keys($folder) as $i) {
6464
$adminObject->addConfigBoxLine($folder[$i], 'folder');
65-
$adminObject->addConfigBoxLine(array($folder[$i], '777'), 'chmod');
65+
$adminObject->addConfigBoxLine([$folder[$i], '777'], 'chmod');
6666
}
6767

6868
// Render Index

‎blocks/repositories.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ function b_wggithub_repositories_show($options)
5656
break;
5757
case 'new':
5858
// For the block: repositories new
59-
$crRepositories->add(new \Criteria('repo_datecreated', \DateTime::createFromFormat(_SHORTDATESTRING), '>='));
60-
$crRepositories->add(new \Criteria('repo_datecreated', \DateTime::createFromFormat(_SHORTDATESTRING) + 86400, '<='));
59+
$crRepositories->add(new \Criteria('repo_datecreated', \time() - 604800, '>='));
60+
$crRepositories->add(new \Criteria('repo_datecreated', \time(), '<='));
6161
$crRepositories->setSort('repo_datecreated');
6262
$crRepositories->setOrder('ASC');
6363
break;

‎class/Common/DirectoryChecker.php‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
<?php
2+
3+
namespace XoopsModules\Wggithub\Common;
4+
5+
/*
6+
You may not change or alter any portion of this comment or credits
7+
of supporting developers from this source code or any supporting source code
8+
which is considered copyrighted (c) material of the original comment or credit authors.
9+
10+
This program is distributed in the hope that it will be useful,
11+
but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13+
*/
14+
15+
/**
16+
* Wggithub module
17+
*
18+
* @copyright XOOPS Project (https://xoops.org)
19+
* @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html)
20+
* @author Xoops Development Team
21+
*/
22+
23+
use Xmf\Request;
24+
use XoopsModules\Wggithub;
25+
26+
27+
require_once \dirname(__DIR__, 4) . '/mainfile.php';
28+
$moduleDirName = \basename(\dirname(__DIR__, 2));
29+
$moduleDirNameUpper = \mb_strtoupper($moduleDirName);
30+
\xoops_loadLanguage('directorychecker', $moduleDirName);
31+
32+
/**
33+
* Class DirectoryChecker
34+
* check status of a directory
35+
*/
36+
class DirectoryChecker
37+
{
38+
/**
39+
* @param $path
40+
* @param int $mode
41+
* @param $redirectFile
42+
*
43+
* @return bool|string
44+
*/
45+
public static function getDirectoryStatus($path, $mode = 0777, $redirectFile = null)
46+
{
47+
$pathIcon16 = \Xmf\Module\Admin::iconUrl('', '16');
48+
49+
if (empty($path)) {
50+
return false;
51+
}
52+
if (null === $redirectFile) {
53+
$redirectFile = $_SERVER['SCRIPT_NAME'];
54+
}
55+
$moduleDirName = \basename(\dirname(__DIR__, 2));
56+
$moduleDirNameUpper = \mb_strtoupper($moduleDirName);
57+
if (!@\is_dir($path)) {
58+
$path_status = "<img src='$pathIcon16/0.png' >";
59+
$path_status .= "$path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_NOTAVAILABLE') . ') ';
60+
$path_status .= "<form action='" . $_SERVER['SCRIPT_NAME'] . "' method='post'>";
61+
$path_status .= "<input type='hidden' name='op' value='createdir'>";
62+
$path_status .= "<input type='hidden' name='path' value='$path'>";
63+
$path_status .= "<input type='hidden' name='redirect' value='$redirectFile'>";
64+
$path_status .= "<button class='submit' onClick='this.form.submit();'>" . \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_CREATETHEDIR') . '</button>';
65+
$path_status .= '</form>';
66+
} elseif (@\is_writable($path)) {
67+
$path_status = "<img src='$pathIcon16/1.png' >";
68+
$path_status .= "$path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_AVAILABLE') . ') ';
69+
$currentMode = \mb_substr(\decoct(\fileperms($path)), 2);
70+
if ($currentMode != \decoct($mode)) {
71+
$path_status = "<img src='$pathIcon16/0.png' >";
72+
$path_status .= $path . \sprintf(\constant('CO_' . $moduleDirNameUpper . '_' . 'DC_NOTWRITABLE'), \decoct($mode), $currentMode);
73+
$path_status .= "<form action='" . $_SERVER['SCRIPT_NAME'] . "' method='post'>";
74+
$path_status .= "<input type='hidden' name='op' value='setdirperm'>";
75+
$path_status .= "<input type='hidden' name='mode' value='$mode'>";
76+
$path_status .= "<input type='hidden' name='path' value='$path'>";
77+
$path_status .= "<input type='hidden' name='redirect' value='$redirectFile'>";
78+
$path_status .= "<button class='submit' onClick='this.form.submit();'>" . \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_SETMPERM') . '</button>';
79+
$path_status .= '</form>';
80+
}
81+
} else {
82+
$currentMode = \mb_substr(\decoct(\fileperms($path)), 2);
83+
$path_status = "<img src='$pathIcon16/0.png' >";
84+
$path_status .= $path . \sprintf(\constant('CO_' . $moduleDirNameUpper . '_' . 'DC_NOTWRITABLE'), \decoct($mode), $currentMode);
85+
$path_status .= "<form action='" . $_SERVER['SCRIPT_NAME'] . "' method='post'>";
86+
$path_status .= "<input type='hidden' name='op' value='setdirperm'>";
87+
$path_status .= "<input type='hidden' name='mode' value='$mode'>";
88+
$path_status .= "<input type='hidden' name='path' value='$path'>";
89+
$path_status .= "<input type='hidden' name='redirect' value='$redirectFile'>";
90+
$path_status .= "<button class='submit' onClick='this.form.submit();'>" . \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_SETMPERM') . '</button>';
91+
$path_status .= '</form>';
92+
}
93+
94+
return $path_status;
95+
}
96+
97+
/**
98+
* @param $target
99+
* @param int $mode
100+
*
101+
* @return bool
102+
*/
103+
public static function createDirectory($target, $mode = 0777)
104+
{
105+
$target = \str_replace('..', '', $target);
106+
107+
// http://www.php.net/manual/en/function.mkdir.php
108+
return \is_dir($target) || (self::createDirectory(\dirname($target), $mode) && !\mkdir($target, $mode) && !\is_dir($target));
109+
}
110+
111+
/**
112+
* @param $target
113+
* @param int $mode
114+
*
115+
* @return bool
116+
*/
117+
public static function setDirectoryPermissions($target, $mode = 0777)
118+
{
119+
$target = \str_replace('..', '', $target);
120+
121+
return @\chmod($target, (int)$mode);
122+
}
123+
124+
/**
125+
* @param $dir_path
126+
*
127+
* @return bool
128+
*/
129+
public static function dirExists($dir_path)
130+
{
131+
return \is_dir($dir_path);
132+
}
133+
}
134+
135+
$op = Request::getString('op', '', 'POST');
136+
switch ($op) {
137+
case 'createdir':
138+
if (\Xmf\Request::hasVar('path', 'POST')) {
139+
$path = $_POST['path'];
140+
}
141+
if (\Xmf\Request::hasVar('redirect', 'POST')) {
142+
$redirect = $_POST['redirect'];
143+
}
144+
$msg = DirectoryChecker::createDirectory($path) ? \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_DIRCREATED') : \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_DIRNOTCREATED');
145+
\redirect_header($redirect, 2, $msg . ': ' . $path);
146+
break;
147+
case 'setdirperm':
148+
if (\Xmf\Request::hasVar('path', 'POST')) {
149+
$path = $_POST['path'];
150+
}
151+
if (\Xmf\Request::hasVar('redirect', 'POST')) {
152+
$redirect = $_POST['redirect'];
153+
}
154+
if (\Xmf\Request::hasVar('mode', 'POST')) {
155+
$mode = $_POST['mode'];
156+
}
157+
$msg = DirectoryChecker::setDirectoryPermissions($path, $mode) ? \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_PERMSET') : \constant('CO_' . $moduleDirNameUpper . '_' . 'DC_PERMNOTSET');
158+
\redirect_header($redirect, 2, $msg . ': ' . $path);
159+
break;
160+
}

‎class/Common/FileChecker.php‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
<?php
2+
3+
namespace XoopsModules\Wggithub\Common;
4+
5+
/*
6+
You may not change or alter any portion of this comment or credits
7+
of supporting developers from this source code or any supporting source code
8+
which is considered copyrighted (c) material of the original comment or credit authors.
9+
10+
This program is distributed in the hope that it will be useful,
11+
but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13+
*/
14+
15+
/**
16+
* Wggithub module
17+
*
18+
* @copyright XOOPS Project (https://xoops.org)
19+
* @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html)
20+
* @author Xoops Development Team
21+
*/
22+
23+
use Xmf\Request;
24+
use XoopsModules\Wggithub;
25+
26+
//\defined('XOOPS_ROOT_PATH') || die('XOOPS root path not defined');
27+
28+
require_once \dirname(__DIR__, 4) . '/mainfile.php';
29+
$moduleDirName = \basename(\dirname(__DIR__, 2));
30+
$moduleDirNameUpper = \mb_strtoupper($moduleDirName);
31+
\xoops_loadLanguage('filechecker', $moduleDirName);
32+
33+
/**
34+
* Class FileChecker
35+
* check status of a directory
36+
*/
37+
class FileChecker
38+
{
39+
/**
40+
* @param string $file_path
41+
* @param string|null $original_file_path
42+
* @param string $redirectFile
43+
* @return bool|string
44+
*/
45+
public static function getFileStatus($file_path, $original_file_path = null, $redirectFile)
46+
{
47+
$pathIcon16 = \Xmf\Module\Admin::iconUrl('', '16');
48+
49+
if (empty($file_path)) {
50+
return false;
51+
}
52+
if (null === $redirectFile) {
53+
$redirectFile = $_SERVER['SCRIPT_NAME'];
54+
}
55+
$moduleDirName = \basename(\dirname(__DIR__, 2));
56+
$moduleDirNameUpper = \mb_strtoupper($moduleDirName);
57+
if (null === $original_file_path) {
58+
if (self::fileExists($file_path)) {
59+
$path_status = "<img src='$pathIcon16/1.png' >";
60+
$path_status .= "$file_path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_AVAILABLE') . ') ';
61+
} else {
62+
$path_status = "<img src='$pathIcon16/0.png' >";
63+
$path_status .= "$file_path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_NOTAVAILABLE') . ') ';
64+
}
65+
} else {
66+
if (self::compareFiles($file_path, $original_file_path)) {
67+
$path_status = "<img src='$pathIcon16/1.png' >";
68+
$path_status .= "$file_path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_AVAILABLE') . ') ';
69+
} else {
70+
$path_status = "<img src='$pathIcon16/0.png' >";
71+
$path_status .= "$file_path (" . \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_NOTAVAILABLE') . ') ';
72+
$path_status .= "<form action='" . $_SERVER['SCRIPT_NAME'] . "' method='post'>";
73+
$path_status .= "<input type='hidden' name='op' value='copyfile'>";
74+
$path_status .= "<input type='hidden' name='file_path' value='$file_path'>";
75+
$path_status .= "<input type='hidden' name='original_file_path' value='$original_file_path'>";
76+
$path_status .= "<input type='hidden' name='redirect' value='$redirectFile'>";
77+
$path_status .= "<button class='submit' onClick='this.form.submit();'>" . \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_CREATETHEFILE') . '</button>';
78+
$path_status .= '</form>';
79+
}
80+
}
81+
82+
return $path_status;
83+
}
84+
85+
/**
86+
* @param $source_path
87+
* @param $destination_path
88+
*
89+
* @return bool
90+
*/
91+
public static function copyFile($source_path, $destination_path)
92+
{
93+
$source_path = \str_replace('..', '', $source_path);
94+
$destination_path = \str_replace('..', '', $destination_path);
95+
96+
return @\copy($source_path, $destination_path);
97+
}
98+
99+
/**
100+
* @param $file1_path
101+
* @param $file2_path
102+
*
103+
* @return bool
104+
*/
105+
public static function compareFiles($file1_path, $file2_path)
106+
{
107+
if (!self::fileExists($file1_path) || !self::fileExists($file2_path)) {
108+
return false;
109+
}
110+
if (\filetype($file1_path) !== \filetype($file2_path)) {
111+
return false;
112+
}
113+
if (\filesize($file1_path) !== \filesize($file2_path)) {
114+
return false;
115+
}
116+
$crc1 = \mb_strtoupper(\dechex(\crc32(\file_get_contents($file1_path))));
117+
$crc2 = \mb_strtoupper(\dechex(\crc32(\file_get_contents($file2_path))));
118+
119+
return !($crc1 !== $crc2);
120+
}
121+
122+
/**
123+
* @param $file_path
124+
*
125+
* @return bool
126+
*/
127+
public static function fileExists($file_path)
128+
{
129+
return \is_file($file_path);
130+
}
131+
132+
/**
133+
* @param $target
134+
* @param int $mode
135+
*
136+
* @return bool
137+
*/
138+
public static function setFilePermissions($target, $mode = 0777)
139+
{
140+
$target = \str_replace('..', '', $target);
141+
142+
return @\chmod($target, (int)$mode);
143+
}
144+
}
145+
146+
$op = Request::getString('op', '', 'POST');
147+
switch ($op) {
148+
case 'copyfile':
149+
if (\Xmf\Request::hasVar('original_file_path', 'POST')) {
150+
$original_file_path = $_POST['original_file_path'];
151+
}
152+
if (\Xmf\Request::hasVar('file_path', 'POST')) {
153+
$file_path = $_POST['file_path'];
154+
}
155+
if (\Xmf\Request::hasVar('redirect', 'POST')) {
156+
$redirect = $_POST['redirect'];
157+
}
158+
$msg = FileChecker::copyFile($original_file_path, $file_path) ? \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_FILECOPIED') : \constant('CO_' . $moduleDirNameUpper . '_' . 'FC_FILENOTCOPIED');
159+
\redirect_header($redirect, 2, $msg . ': ' . $file_path);
160+
break;
161+
}

0 commit comments

Comments
 (0)