Fix a security problem. Thanks to Julien Szlamowicz && Damien Picard …

…from company synacktiv
fusioninventory · Mar 28, 2019 · 0f777f8 · 0f777f8
1 parent 9107173
commit 0f777f8
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/front/send_inventory.php b/front/send_inventory.php
@@ -50,13 +50,12 @@
 //Session::checkRight('config', "w");
 
 $itemtype = $_GET['itemtype'];
-$function = $_GET['function'];
 $items_id = $_GET['items_id'];
 
 header('Cache-control: private, must-revalidate'); /// IE BUG + SSL
 header('Content-disposition: attachment; filename='.$_GET['filename']);
 header('Content-type: text/plain');
 
 
-call_user_func(['PluginFusioninventoryToolbox', $function], $items_id, $itemtype);
+call_user_func(['PluginFusioninventoryToolbox', 'sendXML'], $items_id, $itemtype);
 
diff --git a/inc/toolbox.class.php b/inc/toolbox.class.php
@@ -518,7 +518,8 @@ static function sendSerializedInventory($items_id, $itemtype) {
     * @param string $itemtype
     */
    static function sendXML($items_id, $itemtype) {
-      if (call_user_func([$itemtype, 'canView'])) {
+      if (preg_match("/^([a-zA-Z]+)\/(\d+)\/(\d+)\.xml$/", $items_id)
+         && call_user_func([$itemtype, 'canView'])) {
          $xml = file_get_contents(GLPI_PLUGIN_DOC_DIR."/fusioninventory/xml/".$items_id);
          echo $xml;
       } else {