Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update settings_backup.php #852

Closed
wants to merge 3 commits into from
Closed

Conversation

aftechro
Copy link
Collaborator

@aftechro aftechro commented Jan 2, 2024

Backup and restore from the backup menu. Add backups folder into the uploads, so the backup path will be uploads/backups

https://www.veed.io/view/5bc75a75-9af6-4fc4-a462-6a161c8b9c23?panel=share

Backup and restore from the backup menu. Add backups folder into the uploads, so the backup path will be uploads/backups

https://www.veed.io/view/5bc75a75-9af6-4fc4-a462-6a161c8b9c23?panel=share
@aftechro aftechro requested review from wrongecho and johnnyq January 2, 2024 23:42
settings_backup.php Outdated Show resolved Hide resolved
// Implement delete selected logic here
if (isset($_POST['selectedBackups'])) {
foreach ($_POST['selectedBackups'] as $selectedBackup) {
unlink($backupFolder . $selectedBackup);

Check failure

Code scanning / SonarCloud

I/O function calls should not be vulnerable to path injection attacks High

Change this code to not construct the path from user-controlled data. See more on SonarCloud
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

have no idea what this means

$selectedBackup = $_POST['proceed-restore'];

$sqlFile = $backupFolder . $selectedBackup;
$sqlContent = file_get_contents($sqlFile);

Check failure

Code scanning / SonarCloud

I/O function calls should not be vulnerable to path injection attacks High

Change this code to not construct the path from user-controlled data. See more on SonarCloud
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

again, not sure what this means

@wrongecho
Copy link
Collaborator

Test these changes at: https://patch14852.pr-review.itflow.org
(automatic message)

@aftechro
Copy link
Collaborator Author

aftechro commented Jan 2, 2024

auch, not sure about the security there, but if one of you guys can have a look at it, please do so, thank you!

@wrongecho
Copy link
Collaborator

Hey! It's been a while :)

I can't actually get this to load on PR Review? Screenshot_20240103-075647.png

@aftechro
Copy link
Collaborator Author

aftechro commented Jan 3, 2024

you`ll need to create backups folder inside uploads so path will be uploads/backups. test it locally first :D

@wrongecho
Copy link
Collaborator

wrongecho commented Jan 3, 2024

Ah okay. Is there a way we can do that within the page itself, possibly with mkdirMissing?

Also, is uploads the best location for this? It might be an idea to have it go into a different folder entirely to make restricting access easier if desired.

@aftechro
Copy link
Collaborator Author

aftechro commented Jan 3, 2024

not sure the best approach ( folder structure and security wise), that's why i've asked for second opinion :D i've done the script locally, test it and works. now, going from this, sure, we can make it much better, at least we have a base to work from. still need to figure out the restore from file aspect, which should be another modal uploading file and restore script to handle that file. But with baby steps, and all the great minds, we`ll get there :D

create backups folder in /uploads folder if not exists
create backups and restore
@aftechro aftechro closed this Jan 3, 2024
@aftechro aftechro deleted the patch-14 branch January 3, 2024 09:52
Copy link

sonarqubecloud bot commented Jan 3, 2024

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
13.2% Duplication on New Code

See analysis details on SonarCloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants