Fixed MANTIS-4463 (Upload filenames not obfuscated) (dd07ca30) · Commits · Composr ecosystem / Composr

cms/pages/modules/cms_downloads.php

+2 −2

Original line number	Diff line number	Diff line
		@@ -568,7 +568,7 @@ class Module_cms_downloads extends Standard_crud_module

		$original_filename = '';
		$thumb_url = null;
		$url = post_param_multi_source_upload('file', 'uploads/downloads', true, false, $original_filename, $thumb_url, CMS_UPLOAD_ANYTHING, $copy_to_server == 1);
		$url = post_param_multi_source_upload('file', 'uploads/downloads', true, false, $original_filename, $thumb_url, CMS_UPLOAD_ANYTHING, $copy_to_server == 1, OBFUSCATE_BIN_SUFFIX);

		$metadata = actual_metadata_get_fields('download', null);
		actual_metadata_get_fields__special($metadata, 'num_downloads', 0);
		@@ -646,7 +646,7 @@ class Module_cms_downloads extends Standard_crud_module
		}
		$filename = '';
		$thumb_url = null;
		$url = post_param_multi_source_upload('file', 'uploads/downloads', true, true, $filename, $thumb_url, CMS_UPLOAD_ANYTHING, $copy_to_server == 1);
		$url = post_param_multi_source_upload('file', 'uploads/downloads', true, true, $filename, $thumb_url, CMS_UPLOAD_ANYTHING, $copy_to_server == 1, OBFUSCATE_BIN_SUFFIX);
		} else {
		$url = STRING_MAGIC_NULL;
		}

lang/EN/commandr.ini

+3 −0

Original line number	Diff line number	Diff line
		@@ -211,3 +211,6 @@ CMD_FIND_COMMANDR_FS_FILENAME_VIA_ID_HELP_PARAM_1=ID
		CMD_FIND_ID_VIA_COMMANDR_FS_FILENAME_HELP=Find the Commandr-fs ID from a filename
		CMD_FIND_ID_VIA_COMMANDR_FS_FILENAME_HELP_PARAM_0=Commandr-fs hook name
		CMD_FIND_ID_VIA_COMMANDR_FS_FILENAME_HELP_PARAM_1=Filename
		CMD_OBFUSCATE_DIRECTORY_HELP=Apply (or reapply) filename obfuscation to the files in a directory, and update the database. Use with great care, it changes a lot and cannot be undone.
		CMD_OBFUSCATE_DIRECTORY_HELP_PARAM_0=The name of the directory, e.g. uploads/downloads. Must be a directory relative to the Composr base directory, not a Commandr-fs directory path.
		CMD_OBFUSCATE_DIRECTORY_HELP_PARAM_1=Set to '1' if you want to keep the original file extensions. (Optional)

sources/database.php

+1 −1

Original line number	Diff line number	Diff line
		@@ -1919,7 +1919,7 @@ class DatabaseConnector
		* @param ?integer $start The starting row to update (null: no specific start)
		* @param boolean $num_touched Whether to get the number of touched rows. WARNING: Do not use in core Composr code as it does not work on all database drivers
		* @param boolean $fail_ok Whether to allow failure (outputting a message instead of exiting completely)
		* @return ?integer The number of touched records (null: hasn't been asked / error)
		* @return ?integer The number of touched records (null: hasn't been asked / error / not supported)
		*/
		public function query_update($table, $update_map, $where_map = null, $end = '', $max = null, $start = null, $num_touched = false, $fail_ok = false)
		{

sources/hooks/systems/addon_registry/commandr.php

+1 −0

Original line number	Diff line number	Diff line
		@@ -217,6 +217,7 @@ class Hook_addon_registry_commandr
		'sources/hooks/systems/commandr_commands/check_perms.php',
		'sources/hooks/systems/commandr_commands/integrity_check.php',
		'sources/hooks/systems/commandr_commands/deep_clean.php',
		'sources/hooks/systems/commandr_commands/obfuscate_directory.php',
		'sources/hooks/systems/commandr_fs/bin.php',
		'sources/hooks/systems/commandr_fs/database.php',
		'sources/hooks/systems/commandr_fs/etc.php',

sources/hooks/systems/commandr_commands/obfuscate_directory.php

0 → 100644

+116 −0

Original line number	Diff line number	Diff line
		<?php /*

		Composr
		Copyright (c) ocProducts, 2004-2016

		See text/EN/licence.txt for full licencing information.


		NOTE TO PROGRAMMERS:
		Do not edit this file. If you need to make changes, save your changed file to the appropriate *_custom folder
		** If you ignore this advice, then your website upgrades (e.g. for bug fixes) will likely kill your changes **

		*/

		/**
		* @license http://opensource.org/licenses/cpal_1.0 Common Public Attribution License
		* @copyright ocProducts Ltd
		* @package commandr
		*/

		/**
		* Hook class.
		*/
		class Hook_commandr_command_obfuscate_directory
		{
		/**
		* Run function for Commandr hooks.
		*
		* @param array $options The options with which the command was called
		* @param array $parameters The parameters with which the command was called
		* @param object $commandr_fs A reference to the Commandr filesystem object
		* @return array Array of stdcommand, stdhtml, stdout, and stderr responses
		*/
		public function run($options, $parameters, &$commandr_fs)
		{
		if ((array_key_exists('h', $options)) \|\| (array_key_exists('help', $options))) {
		return array('', do_command_help('obfuscate_directory', array('h'), array(true, true)), '', '');
		} else {
		if (empty($parameters[0])) {
		return array('', '', '', do_lang('MISSING_PARAM', '1', 'obfuscate_directory'));
		}

		$dir = $parameters[0];
		if (substr($dir, -1) == '/') {
		$dir = substr($dir, 0, strlen($dir) - 1);
		}
		$root_path = get_custom_file_base() . '/' . $dir;

		if (!is_dir($root_path)) {
		return array('', '', '', do_lang('NOT_A_DIR', '1'));
		}

		$ext_too = (array_key_exists(1, $parameters)) && ($parameters[1] == '1');

		$_upload_fields = $GLOBALS['SITE_DB']->query_select('db_meta', array('m_table', 'm_name'), array('m_type' => 'URLPATH'));
		$upload_fields = array();
		foreach ($_upload_fields as $field) {
		$sup = ' AND ' . $field['m_name'] . ' LIKE \'' . db_encode_like($dir . '/%') . '\'';
		$has_our_files = $GLOBALS['SITE_DB']->query_select_value_if_there($field['m_table'], $field['m_name'], array(), $sup);
		if ($has_our_files !== null) {
		$upload_fields[] = $field;
		}
		}

		require_code('files2');
		$files = get_directory_contents($root_path);
		foreach ($files as $path) {
		$regexp_ext = 'bin\|dat';
		if ($ext_too) {
		$regexp_ext .= '\|\w+';
		}
		if (preg_match('#^[\da-f]{14}.\d{8}\.(' . $regexp_ext . ')$#', basename($path)) != 0) { // LEGACY: .dat
		continue; // Already obfuscated
		}

		$ext = get_file_extension($path);
		if ($ext == '') {
		continue;
		}

		do {
		$obfuscated_filename_stub = uniqid('', true);
		if ($ext_too) {
		$obfuscated_filename = $obfuscated_filename_stub . '.bin';
		} else {
		$obfuscated_filename = $obfuscated_filename_stub . '.' . $ext;
		}

		$full_path = get_custom_file_base() . '/' . $dir . '/' . $path;
		$obfuscated_full_path = dirname($full_path) . '/' . $obfuscated_filename;
		} while (file_exists($obfuscated_full_path));

		$url = str_replace('%2F', '/', rawurlencode($dir . '/' . $path));
		$obfuscated_url = str_replace('%2F', '/', rawurlencode(dirname($dir . '/' . $path) . '/' . $obfuscated_filename));

		$upload_fields_for_file = array();
		foreach ($upload_fields as $field) {
		$test = $GLOBALS['SITE_DB']->query_select_value_if_there($field['m_table'], $field['m_name'], array($field['m_name'] => $url));
		if ($test !== null) {
		$upload_fields_for_file[] = $field;
		}
		}
		if (!empty($upload_fields_for_file)) {
		$success = rename($full_path, $obfuscated_full_path);
		if ($success) {
		foreach ($upload_fields_for_file as $field) {
		$GLOBALS['SITE_DB']->query_update($field['m_table'], array($field['m_name'] => $obfuscated_url), array($field['m_name'] => $url));
		}
		}
		}
		}

		return array('', '', do_lang('SUCCESS'), '');
		}
		}
		}