From 5d175b76930362f09a91da59f309712cc9dedfcf Mon Sep 17 00:00:00 2001 From: "AFTECH.RO" <38830718+aftechro@users.noreply.github.com> Date: Wed, 3 Jan 2024 10:23:03 +0000 Subject: [PATCH 1/2] Update settings_backup.php create uploads/backups folder if not exists. done some security. to do, restore from file --- settings_backup.php | 239 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 218 insertions(+), 21 deletions(-) diff --git a/settings_backup.php b/settings_backup.php index 7c42002b8..ece00e6bb 100644 --- a/settings_backup.php +++ b/settings_backup.php @@ -1,37 +1,234 @@ -
-
-

Download Database

+$backupFolder = 'uploads/backups/'; + +// Check if the backup folder inside uploads exists, if not, create it +$uploadsBackupsFolder = 'uploads/backups/'; +if (!file_exists($uploadsBackupsFolder) || !is_dir($uploadsBackupsFolder)) { + if (!mkdir($uploadsBackupsFolder, 0777, true)) { + die('Failed to create backups folder inside uploads'); + } +} + +$backups = array_diff(scandir($backupFolder), array('..', '.')); + +// Database connection +$mysqli = mysqli_connect($dbhost, $dbusername, $dbpassword, $database) or die('Database Connection Failed'); +$conn = new mysqli($dbhost, $dbusername, $dbpassword, $database); + +// Handle backup action +if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST['backup'])) { + // Create a backup + $backupFileName = date("d-m-Y_H-i-s") . ".sql"; + $backupPath = $backupFolder . $backupFileName; + + // Run mysqldump command to include table content + $escapedBackupPath = escapeshellarg($backupPath); + $command = "mysqldump --complete-insert --skip-comments -h $dbhost -u $dbusername -p$dbpassword $database > $escapedBackupPath"; + exec($command); + + // Refresh backup list after creating a new backup + $backups = array_diff(scandir($backupFolder), array('..', '.')); +} + +// Handle restore action +if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST['proceed-restore'])) { + $selectedBackup = $_POST['proceed-restore']; + + // Use realpath to get the canonicalized absolute pathname + $sqlFile = realpath($backupFolder . $selectedBackup); + + // Check if the obtained path is within the allowed directory + if ($sqlFile !== false && strpos($sqlFile, realpath($backupFolder)) === 0) { + $sqlContent = file_get_contents($sqlFile); + + // Remove comments and split into separate queries + $sqlQueries = preg_split('/;(?=(?:[^\'"]*[\'"][^\'"]*[\'"])*[^\'"]*$)/', $sqlContent); + + foreach ($sqlQueries as $query) { + $query = trim($query); + if (!empty($query)) { + // Execute each query separately using $conn + $result = $conn->query($query); + + // Check for execution success + if ($result === false) { + die("Error executing query: " . $conn->error); + } + } + } + + // Display success message + echo ''; + } else { + // Log an error or take appropriate action for invalid paths + echo 'Invalid backup path: ' . $sqlFile; + } +} + +// Handle delete action +if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST['delete'])) { + $selectedBackup = $_POST['delete']; + + // Validate the selectedBackup variable to prevent directory traversal + if (in_array($selectedBackup, $backups)) { + unlink($backupFolder . $selectedBackup); + } +} + +// Handle delete selected action +if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST['delete-selected'])) { + // Implement delete selected logic here + if (isset($_POST['selectedBackups'])) { + foreach ($_POST['selectedBackups'] as $selectedBackup) { + unlink($backupFolder . $selectedBackup); + } + } +} + +// Reverse the order of backups to display the latest on top +$backups = array_reverse(array_diff(scandir($backupFolder), array('..', '.'))); + +// Function to format file size in human-readable format +function formatBytes($bytes, $decimals = 2) +{ + $size = ['B', 'kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB']; + + $factor = floor((strlen($bytes) - 1) / 3); + + return sprintf("%.{$decimals}f", $bytes / (1024 ** $factor)) . ' ' . @$size[$factor]; +} + +?> + + + +
+
+
+
+

Backup Database

+
+
+
+ + +
+
+
-
-

Download + +
+
+
+

Backup Master Encryption Key

+
+
+
+ +
+
+
+ +
+ +
+
+
+
+
+ +
-

Backup Master Encryption Key

+

Backup Manager

-
-
- -
-
-
- + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + + + + +
SelectBackup NameFile SizeActionsDownload
+ + + Download
+ +
-
+
+ + From 69b4fe218e4b51dca1defc34fece481cebfd3687 Mon Sep 17 00:00:00 2001 From: "AFTECH.RO" <38830718+aftechro@users.noreply.github.com> Date: Wed, 3 Jan 2024 10:26:41 +0000 Subject: [PATCH 2/2] Update settings_backup.php --- settings_backup.php | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/settings_backup.php b/settings_backup.php index ece00e6bb..2b5cefd9e 100644 --- a/settings_backup.php +++ b/settings_backup.php @@ -85,11 +85,20 @@ // Implement delete selected logic here if (isset($_POST['selectedBackups'])) { foreach ($_POST['selectedBackups'] as $selectedBackup) { - unlink($backupFolder . $selectedBackup); + $backupPath = $backupFolder . $selectedBackup; + + // Validate the file path to prevent directory traversal + if (is_file($backupPath) && strpos(realpath($backupPath), realpath($backupFolder)) === 0) { + unlink($backupPath); + } else { + // Log an error or take appropriate action for invalid paths + echo 'Invalid backup path: ' . $backupPath; + } } } } + // Reverse the order of backups to display the latest on top $backups = array_reverse(array_diff(scandir($backupFolder), array('..', '.')));