Skip to content

fix(security): 修复模板预览任意文件读取 #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PGwind wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): 修复模板预览任意文件读取 #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
161 changes: 92 additions & 69 deletions template/preview.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,84 +1,107 @@
<?php
$theme = empty($_GET['theme']) ? '' : $_GET['theme'];
$file = empty($_GET['file']) ? '' : $_GET['file'];
//获取评论模板
function getTemplate($templateDir = 'default',$template = 'owner.html')
{
$filePath = dirname(__FILE__) . '/' . $templateDir . '/' . $template;
header('Cache-Control: no-store');
header("Content-Security-Policy: script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'");
header('Referrer-Policy: no-referrer');
header('X-Content-Type-Options: nosniff');

if (!file_exists($filePath)) {//如果模板文件缺失就调用根目录下的default文件夹中用于垫底的模板
return '预览的主题文件夹或主题文件不存在';
}
$theme = isset($_GET['theme']) && is_string($_GET['theme']) ? trim($_GET['theme']) : 'default';
$file = isset($_GET['file']) && is_string($_GET['file']) ? trim($_GET['file']) : 'owner.html';
$allowedFiles = ['owner.html', 'guest.html', 'notice.html'];
$templateRoot = realpath(__DIR__);
$themeDir = preg_match('/\A[A-Za-z0-9_-]+\z/D', $theme)
? realpath(__DIR__ . DIRECTORY_SEPARATOR . $theme)
: false;
$filePath = $themeDir && in_array($file, $allowedFiles, true)
? realpath($themeDir . DIRECTORY_SEPARATOR . $file)
: false;

$content=file_get_contents($filePath);
$content=preg_replace('#<\?php#', '<!--', $content);
$content=preg_replace('#\?>#', '-->', $content);
$demouser = array(
array('name' => '月宅', 'md5' => 'bf413cdf4570464b971cb6e0f0a0437a'),
array('name' => '念', 'md5' => '138be792998aef019362d52276290752'),
array('name' => 'Jochen', 'md5' => '076176b67617855818a00f3e5f963262'),
array('name' => '吃猫的鱼', 'md5' => 'e2909ce0b9d612c601733aea588c0097'),
array('name' => '清酒', 'md5' => '60dfa69a58fae040fb0feb753bef1535'),
array('name' => '凡涛', 'md5' => 'b8f7b5a08bcba93c2c3eff7b1c5a7c32'),
);
if (
false === $templateRoot
|| false === $themeDir
|| dirname($themeDir) !== $templateRoot
|| false === $filePath
|| dirname($filePath) !== $themeDir
|| !is_file($filePath)
) {
http_response_code(404);
exit('预览的主题文件夹或主题文件不存在');
}

// 随机选择两个不同的数组元素
$index1 = rand(0, count($demouser) - 1);
$index2 = array_rand(array_diff_key($demouser, [$index1 => '']));

$search = array(
'{title}',//文章标题
'{PostAuthor}',//文章作者昵称
'{time}',//评论发出时间
'{commentText}',//评论内容
'{author}',//评论人昵称
'{mail}',//评论者邮箱
'{md5}',//评论者邮箱
'{ip}',//评论者ip
'{permalink}',//评论楼层链接
'{siteUrl}',//网站地址
'{siteTitle}',//网站标题
'{Pname}',//父级评论昵称
'{Ptext}',//父级评论内容
'{Pmail}',//父级评论邮箱
'{Ptime}',//父级评论时间
'{Pmd5}',//父级评论邮箱md5
'{url}',//当前模板文件夹路径
'{manageurl}',//后台管理评论的入口链接
'{status}', //评论状态
);
$replace = array(
'CommentNotifier邮件提醒插件',
'泽泽社长',
date('Y-m-d H:i:s'),
'这个插件真好用！',
$demouser[$index1]['name'],
'10000@qq.com',
$demouser[$index1]['md5'],
'172.0.0.1',
'https://github.com/jrotty/CommentNotifier',
'https://typecho.fans',
'泽泽社',
$demouser[$index2]['name'],
'这个插件真好用!',
'zezeshe@foxmail.com',
date('Y-m-d H:i:s'),
$demouser[$index2]['md5'],
'./' . $templateDir.'/',
'https://typecho.fans',
'通过'
);
return str_replace($search, $replace, $content);
function renderCommentNotifierPreviewTemplate(string $filePath, string $templateDir): string
{
$content = file_get_contents($filePath);
if (false === $content) {
return '预览文件读取失败';
}

$content = preg_replace('#<\?php#', '<!--', $content);
$content = preg_replace('#\?>#', '-->', $content);
$demoUsers = [
['name' => '月宅', 'md5' => 'bf413cdf4570464b971cb6e0f0a0437a'],
['name' => '念', 'md5' => '138be792998aef019362d52276290752'],
['name' => 'Jochen', 'md5' => '076176b67617855818a00f3e5f963262'],
['name' => '吃猫的鱼', 'md5' => 'e2909ce0b9d612c601733aea588c0097'],
['name' => '清酒', 'md5' => '60dfa69a58fae040fb0feb753bef1535'],
['name' => '凡涛', 'md5' => 'b8f7b5a08bcba93c2c3eff7b1c5a7c32'],
];

$index1 = rand(0, count($demoUsers) - 1);
$index2 = array_rand(array_diff_key($demoUsers, [$index1 => '']));
$search = [
'{title}',
'{PostAuthor}',
'{time}',
'{commentText}',
'{author}',
'{mail}',
'{md5}',
'{ip}',
'{permalink}',
'{siteUrl}',
'{siteTitle}',
'{Pname}',
'{Ptext}',
'{Pmail}',
'{Ptime}',
'{Pmd5}',
'{url}',
'{manageurl}',
'{status}',
];
$replace = [
'CommentNotifier邮件提醒插件',
'泽泽社长',
date('Y-m-d H:i:s'),
'这个插件真好用！',
$demoUsers[$index1]['name'],
'10000@qq.com',
$demoUsers[$index1]['md5'],
'172.0.0.1',
'https://github.com/jrotty/CommentNotifier',
'https://typecho.fans',
'泽泽社',
$demoUsers[$index2]['name'],
'这个插件真好用!',
'zezeshe@foxmail.com',
date('Y-m-d H:i:s'),
$demoUsers[$index2]['md5'],
'./' . $templateDir . '/',
'https://typecho.fans',
'通过',
];
return str_replace($search, $replace, $content);
}

$previewContent = renderCommentNotifierPreviewTemplate($filePath, $theme);
?>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="renderer" content="webkit">
<meta name="viewport" content="width=device-width,user-scalable=no,viewport-fit=cover,initial-scale=1, maximum-scale=1">
<title>预览<?php echo $file; ?> - <?php echo $theme; ?>主题</title>
<title>预览<?php echo htmlspecialchars($file, ENT_QUOTES, 'UTF-8'); ?> - <?php echo htmlspecialchars($theme, ENT_QUOTES, 'UTF-8'); ?>主题</title>
</head>
<body>
<?php echo getTemplate($theme,$file);?>
<?php echo $previewContent; ?>
</body>
</html>