Home › Support › Bug Reports
Howdy, Stranger!
It looks like you're new here. If you want to get involved, click one of these buttons!
CRITICAL SECURITY VERSION UPDATE:
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13
Insecure generation of "file" type fields in form_fields method of Base_module_model class
When we create modules, one way we can generate file type fields in the form is using the following instructions (as an example):
class Items_venta_model extends Base_module_model{
...
public function form_fields($values = array())
{
...
$fields['ITVE_DESCARGA']['type'] = "file";
$fields['ITVE_DESCARGA']['upload_path'] = "D:/Archivos de Programa/winginx/home/localhost/public_html/colosoft/assets/images/products/";
$fields['ITVE_DESCARGA']['overwrite'] = TRUE;
}
}
The problem is that fuel generate the following HTML code: http://s16.postimage.org/nt7ygyac5/bug_fuel_cms_01.png
In this way, a hacker would know the path of the directory of the server.
I would appreciate that give priority to this bug, because I consider that is critical for create secure modules. Thanks!
class Items_venta_model extends Base_module_model{
...
public function form_fields($values = array())
{
...
$fields['ITVE_DESCARGA']['type'] = "file";
$fields['ITVE_DESCARGA']['upload_path'] = "D:/Archivos de Programa/winginx/home/localhost/public_html/colosoft/assets/images/products/";
$fields['ITVE_DESCARGA']['overwrite'] = TRUE;
}
}
The problem is that fuel generate the following HTML code: http://s16.postimage.org/nt7ygyac5/bug_fuel_cms_01.png
In this way, a hacker would know the path of the directory of the server.
I would appreciate that give priority to this bug, because I consider that is critical for create secure modules. Thanks!
Comments
https://github.com/daylightstudio/FUEL-CMS/tree/1.0
If you cannot use the 1.0 branch, perhaps you could implement something similar on your model using the on_before_post hook to decrypt the upload_path on the $_POST variable that eventually gets used in processing the uploaded file.