security issue in DemoCompUpdate component

Joomla! Documentation Workgroup

Moderator: Documentation

Locked
User avatar
carsten888
Joomla! Ace
Joomla! Ace
Posts: 1221
Joined: Sat Feb 11, 2006 8:32 am
Contact:

security issue in DemoCompUpdate component

Post by carsten888 » Sun Jan 06, 2013 6:10 pm

In the download on this page
http://docs.joomla.org/Managing_Compone ... 6_-_Part_1
the var 'controller' can be manipulated to include onther files in democompupdate.php.

If someone was to take this demo code as a base for an extension, it would be vunerability waiting to be abused.
http://www.pages-and-items.com my extensions:
User-Private-Page, Redirect-on-Login, Admin-Help-Pages, Dynamic-Menu-Links, Admin-Menu-Manager, plugin load module in article, plugin pure css tooltip and more...

User avatar
Chris Davenport
Joomla! Ace
Joomla! Ace
Posts: 1385
Joined: Thu Aug 18, 2005 8:57 am
Location: Shrewsbury, Shropshire, United Kingdom

Re: security issue in DemoCompUpdate component

Post by Chris Davenport » Sun Jan 06, 2013 7:05 pm

Thanks for the report. Please feel free to correct it.

Chris.
Chris Davenport

Davenport Technology Services http://www.davenporttechnology.com/
Lion Coppice http://www.lioncoppice.org/

User avatar
carsten888
Joomla! Ace
Joomla! Ace
Posts: 1221
Joined: Sat Feb 11, 2006 8:32 am
Contact:

Re: security issue in DemoCompUpdate component

Post by carsten888 » Mon Jan 07, 2013 6:47 am

Code: Select all

// Require specific controller if requested
if ( $controller = JRequest::getVar( 'controller' ) )
{
    $path = JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php';
    if ( file_exists( $path ) ) { require_once $path; }
    else { $controller = ''; }
}

// Create the controller
$classname    = 'DemocompupdateController'.ucfirst($controller);
$controller   = new $classname( );
replace with

Code: Select all

$controller   = new DemocompupdateController( );
http://www.pages-and-items.com my extensions:
User-Private-Page, Redirect-on-Login, Admin-Help-Pages, Dynamic-Menu-Links, Admin-Menu-Manager, plugin load module in article, plugin pure css tooltip and more...

ashwani1489
Joomla! Apprentice
Joomla! Apprentice
Posts: 24
Joined: Mon Dec 31, 2012 12:21 pm
Location: Noida
Contact:

Re: security issue in DemoCompUpdate component

Post by ashwani1489 » Mon Jan 07, 2013 7:13 am

Hello carsten888,
I am new to joomla, and eager to know how it is a vulnerability. The code you have suggested is not substitute of what is written above. What to do if we use your code in controller and want to use multiple controllers for diffrent purpose.

thanks

ashwani1489
Joomla! Apprentice
Joomla! Apprentice
Posts: 24
Joined: Mon Dec 31, 2012 12:21 pm
Location: Noida
Contact:

Re: security issue in DemoCompUpdate component

Post by ashwani1489 » Mon Jan 07, 2013 7:16 am

I used the same code while i make any custom component. so i want to know how it is a vulnerability so that i may also make a secure custom component in future.

thanks

User avatar
carsten888
Joomla! Ace
Joomla! Ace
Posts: 1221
Joined: Sat Feb 11, 2006 8:32 am
Contact:

Re: security issue in DemoCompUpdate component

Post by carsten888 » Mon Jan 07, 2013 9:43 am

@ashwani1489
yes, that code does not do the same. This component only has 1 controller, so that is the savest way to do that.
For how to deal with more then one controller read the tut here:
http://docs.joomla.org/Developing_a_Mod ... _-_Part_02
o, shoot, I just noticed that is not in the tut. :eek:

Code: Select all

// Require specific controller if requested
if ( $controller = JRequest::getVar( 'controller' ) )
{
    $path = JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php';
    if ( file_exists( $path ) ) { require_once $path; }
    else { $controller = ''; }
}

// Create the controller
$classname    = 'DemocompupdateController'.ucfirst($controller);
$controller   = new $classname( );
replace with:

Code: Select all


// Require specific controller if requested
if ( $controller = JRequest::getVar( 'controller' ) )
{
    $path = JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php';
	$allowed_controllers = array('items', 'categories');//specify here all allowed controllers
    if ( file_exists( $path ) && in_array($controller, $allowed_controllers)) { require_once $path; }
    else { $controller = ''; }
}

// Create the controller
$classname    = 'DemocompupdateController'.ucfirst($controller);
$controller   = new $classname( );
http://www.pages-and-items.com my extensions:
User-Private-Page, Redirect-on-Login, Admin-Help-Pages, Dynamic-Menu-Links, Admin-Menu-Manager, plugin load module in article, plugin pure css tooltip and more...

ashwani1489
Joomla! Apprentice
Joomla! Apprentice
Posts: 24
Joined: Mon Dec 31, 2012 12:21 pm
Location: Noida
Contact:

Re: security issue in DemoCompUpdate component

Post by ashwani1489 » Tue Jan 08, 2013 10:11 am

carsten888 wrote:@ashwani1489
yes, that code does not do the same. This component only has 1 controller, so that is the savest way to do that.
For how to deal with more then one controller read the tut here:
http://docs.joomla.org/Developing_a_Mod ... _-_Part_02
o, shoot, I just noticed that is not in the tut. :eek:

Code: Select all

// Require specific controller if requested
if ( $controller = JRequest::getVar( 'controller' ) )
{
    $path = JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php';
    if ( file_exists( $path ) ) { require_once $path; }
    else { $controller = ''; }
}

// Create the controller
$classname    = 'DemocompupdateController'.ucfirst($controller);
$controller   = new $classname( );
replace with:

Code: Select all


// Require specific controller if requested
if ( $controller = JRequest::getVar( 'controller' ) )
{
    $path = JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php';
	$allowed_controllers = array('items', 'categories');//specify here all allowed controllers
    if ( file_exists( $path ) && in_array($controller, $allowed_controllers)) { require_once $path; }
    else { $controller = ''; }
}

// Create the controller
$classname    = 'DemocompupdateController'.ucfirst($controller);
$controller   = new $classname( );
thanks for your nice explaination


Locked

Return to “docs.joomla.org - Feedback/Information”