Finish task#3272 后台-二次开发-编辑器 存在安全漏洞,cost:1 left:0

module/editor/control.php

@@ -58,6 +58,7 @@ class editor extends control
         if($filePath)
         {
             $filePath = helper::safe64Decode($filePath);
+            if(strpos(strtolower($filePath), strtolower($this->app->getBasePath())) !== 0) die($this->lang->editor->editFileError);
             if($action == 'extendOther' and file_exists($filePath))
             {
                 $this->view->showContent = htmlspecialchars(file_get_contents($filePath));
@@ -142,6 +143,7 @@ class editor extends control
         if($filePath and $_POST)
         {
             $filePath = helper::safe64Decode($filePath);
+            if(strpos(strtolower($filePath), strtolower($this->app->getBasePath())) !== 0) die($this->lang->editor->editFileError);
             if($action != 'edit' and $action != 'newPage') $filePath = $this->editor->getSavePath($filePath, $action);
             if($action != 'edit' and $action != 'newPage' and file_exists($filePath) and !$this->post->override) die(js::error($this->lang->editor->repeatFile));
             $this->editor->save($filePath);

module/editor/lang/en.php

@@ -31,6 +31,7 @@ $lang->editor->extendConfirm = 'Do you want to use original code?';
 $lang->editor->repeatFile    = 'File Name Dupliceted';
 $lang->editor->repeatPage    = 'Page existed. Do you want to override it?';
 $lang->editor->noticeOkFile  = 'For security reasons, your Admin account has to be confirmed. \n Please login ZenTao server and create %sFile.\n Note:\n 1. File is blank.\n 2. If the file existed, delete it and then create a new one.';
+$lang->editor->editFileError = 'You can only modify Zentao files!';
 
 $lang->editor->notWritable   = "Not wirtable. Privilege is required. Please try chmod 777 -R ";
 $lang->editor->notDelete     = 'Cannot be deleted. Please check your permission!';

module/editor/lang/zh-cn.php

@@ -31,6 +31,7 @@ $lang->editor->extendConfirm = '是否要重用原来代码？';
 $lang->editor->repeatFile    = '文件名重复';
 $lang->editor->repeatPage    = '已经有此页面。是否覆盖？';
 $lang->editor->noticeOkFile  = '为了安全起见，系统需要确认您的管理员身份。\n 请登录禅道所在的服务器，创建%s文件。\n 注意：\n 1. 文件内容为空。\n 2. 如果之前文件存在，删除之后重新创建。';
+$lang->editor->editFileError = '只能修改禅道文件！';
 
 $lang->editor->notWritable   = "无法写入，可能没有权限。请尝试执行 chmod 777 -R ";
 $lang->editor->notDelete     = '无法删除，请检查权限！';