WordPress.org
Get WordPress

Plugin Directory

Changeset 496048


Ignore:
Timestamp:
01/27/2012 09:26:34 AM (14 years ago)
Author:
camaleo
Message:

1.0.11 Improves the fix applied with version 1.0.9 and fixes the possibility for malicious user to discover the directory structure of the target site as kindly reported by Pavel Komisarchuk of 6scan.com

Location:
myeasybackup/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • myeasybackup/trunk/ajax_ro.php

    r403768 r496048  
    66 * @author Ugo Grandolini
    77 * @since 0.1.3
    8  * @version 1.0.5.7
     8 * @version 1.0.11
    99 */
    1010
    … …  
    3838//$referer = $path[0];
    3939//echo '$referer['.$referer.']';
     40//var_dump($_SERVER);
     41
    4042/*
    4143 * var_dump($_SERVER);
    … …  
    5658    && isset($_SERVER['HTTP_REFERER'])) { /* this entire condition @since 1.0.5.9 */
    5759
    58     if(stripos($_SERVER['HTTP_HOST'], $_SERVER['SERVER_NAME'])!==false
    59         && stripos($_SERVER['HTTP_HOST'], $_SERVER['HTTP_REFERER'])!==false) {
     60    if(stripos($_SERVER['HTTP_HOST'], $_SERVER['SERVER_NAME']) !== false
     61        && stripos($_SERVER['HTTP_HOST'], $_SERVER['HTTP_REFERER']) !== false) {
    6062#-------------
    6163#   1.0.0: END
    6264#
    63         echo $_POST['tag']
     65        echo strip_tags($_POST['tag'])
    6466            .$splitter_tag
    6567            .'<div class="warning">'
    … …  
    128130}
    129131
     132
     133
     134
     135if(!function_exists('wp_create_nonce')) {
     136
     137    require_once( ABSPATH . 'wp-includes/pluggable.php');
     138}
     139
     140$meb_backup_ajax_validator = $parms[(count($parms) - 1)];
     141$meb_backup_ajax_validator_key = dirname(__FILE__);
     142
     143if(! wp_verify_nonce($meb_backup_ajax_validator, $meb_backup_ajax_validator_key)) {
     144
     145    /**
     146     * @since 1.0.11
     147     */
     148    echo strip_tags($_POST['tag']) . $splitter_tag
     149        . '<div class="warning">'
     150            . __( 'There is an issue with the caller...', MEBAK_LOCALE )
     151//          . '<br>' . $meb_backup_ajax_validator . ' | ' . $meb_backup_ajax_validator_key . ' = ' . wp_verify_nonce($meb_backup_ajax_validator, $meb_backup_ajax_validator_key) // debug
     152        . '</div>';
     153
     154    exit();
     155}
     156
    130157#
    131158#   $parms
    … …  
    260287                .'<div style="float:left;">'
    261288                    .'<p style="margin:0;cursor:pointer;" onclick="javascript:'
    262                                     .'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$up_folder.'\');'
     289                                    .'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$up_folder . AJAX_PARMS_SPLITTER . $meb_backup_ajax_validator .'\');'
    263290                                    .'">'
    264291//. '{{{ back to: '.$up_folder.' }}}'
    … …  
    296323
    297324                    echo '<p class="item_folder" style="margin:0;cursor:pointer;" onclick="javascript:'
    298                                         .'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$parms[0].'/'.$fname.'\');'
     325                                        .'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$parms[0].'/'.$fname . AJAX_PARMS_SPLITTER . $meb_backup_ajax_validator .'\');'
    299326                                        .'">' . $tmp . $fname . '</p>';
    300327                    $t++;
    … …  
    321348                . '</p>'
    322349
    323                 .'<input id="new_folder" name="newfolder" type="text" value="'.$_POST['newfolder'].'" size="40" maxlength="128" />'
     350                .'<input id="new_folder" name="newfolder" type="text" value="' . strip_tags($_POST['newfolder']) . '" size="40" maxlength="128" />' // 1.0.11
    324351
    325352                .'<div style="text-align:right;margin-top:8px;">'
    … …  
    329356                                        .'if(document.getElementById(\'new_folder\').value!=\'\'){'
    330357//.'alert(document.getElementById(\'new_folder\').value);'  #debug
    331                                             .'sndReq(\'create_dir_exec\',\'dirs_list_container_msgs\',\''.$parms[0].AJAX_PARMS_SPLITTER.'\'+document.getElementById(\'new_folder\').value);'
     358                                            .'sndReq(\'create_dir_exec\',\'dirs_list_container_msgs\',\''.$parms[0].AJAX_PARMS_SPLITTER.'\'+document.getElementById(\'new_folder\').value+\''. AJAX_PARMS_SPLITTER . $meb_backup_ajax_validator .'\');'
    332359                                        .'}else{'
    333360                                            .'alert(\''.__( 'Please enter the name of the folder you want to create!', MEBAK_LOCALE ) . '\');'
    … …  
    370397                    echo '<span style="color:green;">' . __( 'Done!', MEBAK_LOCALE ) . '</span>';
    371398
    372                     $js = 'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$parms[0].'/'.$parms[1].'\');';
     399                    $js = 'sndReq(\'get_site_dirs_list\',\'dirs_list_container\',\''.$parms[0].'/'.$parms[1] . AJAX_PARMS_SPLITTER . $meb_backup_ajax_validator .'\');';
    373400                }
    374401                else

  • myeasybackup/trunk/inc/myEASYcom.php

    r491959 r496048  
    33 * myEASYcom.php: common functions for the myEASYwp plugins serie
    44 *
     5 * Version: 1.4 - 26 January 2012
    56 * Version: 1.3 - 23 July 2011
    67 * Author: Ugo Grandolini aka "Camaleo"

  • myeasybackup/trunk/meb-config.php

    r414034 r496048  
    66 * @author Ugo Grandolini
    77 */
    8 define('MYEASYBACKUP_VERSION', '1.0.6');
     8define('MYEASYBACKUP_VERSION', '1.0.10');
    99define('MEBAK_LOCALE', 'myEASYbackup');     #   the locale for translations - 1.0.5.1
    1010

  • myeasybackup/trunk/meb_download.php

    r491118 r496048  
    4545$file = MEBAK_BACKUP_PATH . '/' . $file_name;
    4646
    47 if(file_exists($file))
     47//if(file_exists($file))                    // 1.0.9
     48if(file_exists($file) && (!is_dir($file)))  // 1.0.11
    4849{
    4950    $bytes = filesize($file);

  • myeasybackup/trunk/meb_settings.php

    r414034 r496048  
    13461346                                    .'\'+document.getElementById(\'meb_ftp_timeout\').value+\''.AJAX_PARMS_SPLITTER
    13471347                                    .'\'+pasv+\''.AJAX_PARMS_SPLITTER
     1348                                    . MEB_BACKUP_AJAX_VALIDATOR
    13481349                        .'\');'
    13491350                        .'return false;'
    … …  
    14251426
    14261427        ?><div id="dirs_list_container" style="background-color:#F1F1F1;width:100%;border:1px solid #DFDFDF;margin:0 0 8px 0;padding:8px;-moz-border-radius:6px;border-radius:6px;"></div>
    1427         <script type="text/javascript">sndReq('get_site_dirs_list','dirs_list_container','<?php echo $_POST['meb_backup_root']; ?>');</script>
     1428        <script type="text/javascript">sndReq('get_site_dirs_list','dirs_list_container','<?php echo $_POST['meb_backup_root'] . AJAX_PARMS_SPLITTER . MEB_BACKUP_AJAX_VALIDATOR; /* 1.0.10 */ ?>');</script>
    14281429    </div>
    14291430    <div style="clear:both;"></div>
    … …  
    14871488                                        .'pwd+\''.AJAX_PARMS_SPLITTER
    14881489                                        .'\'+document.getElementById(\'meb_ally_pubkey\').value+\''.AJAX_PARMS_SPLITTER
     1490                                        . MEB_BACKUP_AJAX_VALIDATOR
    14891491                            .'\');'
    14901492                            .'return false;'

  • myeasybackup/trunk/myeasybackup.php

    r491720 r496048  
    44Plugin URI: http://myeasywp.com/plugins/myeasybackup/
    55Description: Backup your WordPress site (code and database) with a click.
    6 Version: 1.0.9
     6Version: 1.0.11
    77Author: Ugo Grandolini aka "camaleo"
    88Author URI: http://grandolini.com
    99*/
    1010/*
    11     Copyright (C) 2010 Ugo Grandolini  (email : [email protected])
     11    Copyright (C) 2010,2012 Ugo Grandolini  (email : [email protected])
    1212
    1313    This program is free software: you can redistribute it and/or modify
    … …  
    8383define('MYEASY_CDN_CSS', MYEASY_CDN . 'css/');
    8484define('MYEASY_CDN_JS', MYEASY_CDN . 'js/');
    85 
    8685/* 1.0.8: END */
    8786
     87
     88/* 1.0.11: BEG */
     89if(!defined('AJAX_CALLER') || AJAX_CALLER == false) {
     90
     91    if(!function_exists('wp_create_nonce')) {
     92
     93        require_once( ABSPATH . 'wp-includes/pluggable.php');
     94    }
     95    $meb_backup_ajax_validator_key = dirname(__FILE__);
     96    $meb_backup_ajax_validator = wp_create_nonce($meb_backup_ajax_validator_key);
     97
     98    define('MEB_BACKUP_AJAX_VALIDATOR_KEY', $meb_backup_ajax_validator_key);
     99    define('MEB_BACKUP_AJAX_VALIDATOR', $meb_backup_ajax_validator);
     100}
     101/* 1.0.11: END */
    88102
    89103

  • myeasybackup/trunk/readme.txt

    r491118 r496048  
    44Tags: myeasy, backup, migrate, admin, administration, ajax, comments, google, facebook, image, images, links, jquery, plugin, plugins, post, posts, rss, seo, sidebar, social, twitter, video, widget, wordpress, youtube
    55Requires at least: 2.5
    6 Tested up to: 3.3
    7 Stable tag: trunk
     6Tested up to: 3.3.*
     7Stable tag: 1.0.11
    88
    99Backup, restore, migrate your WP installation, both code and MySQL tables, with a single click. <a href="http://is.gd/hUwBx" target="_blank">Screen shots</a>
    … …  
    7070== Changelog ==
    7171
     72= 1.0.11 (27 January 2012) =
     73Improves the fix applied with version 1.0.9 and fixes the possibility for malicious user to discover the directory structure of the target site as kindly reported by Pavel Komisarchuk of <a href="http://6scan.com/" target="_blank">6scan.com</a>.
     74
    7275= 1.0.9 (17 January 2012) =
    73 Fixes the exploit described at <a href="http://packetstormsecurity.org/files/108711/">Packet Storm</a>.
     76Fixes the exploit described at <a href="http://packetstormsecurity.org/files/108711/" target="_blank">Packet Storm</a>.
    7477
    7578= 1.0.8.1 (24 July 2011) =
Note: See TracChangeset for help on using the changeset viewer.