MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

new: Stricter validation of baseurl when coming via the API tool

pull/3283/head
iglocska 2018-05-26 06:55:28 +02:00
parent 4f90bf2dc7
commit 2ed4ecec02
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Console/Command/BaseurlShell.php
View File

@ -10,7 +10,12 @@ class BaseurlShell extends AppShell {
public function main() {
$baseurl = $this->args[0];
$this->Server->serverSettingsSaveValue('MISP.baseurl', $baseurl);
echo 'Baseurl updated. Have a very safe and productive day.', PHP_EOL;
$result = $this->Server->testBaseURL($baseurl);
if (true !== $result) {
echo $result . PHP_EOL;
} else {
$this->Server->serverSettingsSaveValue('MISP.baseurl', $baseurl);
echo 'Baseurl updated. Have a very safe and productive day.', PHP_EOL;
}
}
}

3
app/Controller/AppController.php
View File

@ -51,6 +51,8 @@ class AppController extends Controller {
public $phpmin = '5.6.5';
public $phprec = '7.0.16';
public $baseurl = '';
// Used for _isAutomation(), a check that returns true if the controller & action combo matches an action that is a non-xml and non-json automation method
// This is used to allow authentication via headers for methods not covered by _isRest() - as that only checks for JSON and XML formats
public $automationArray = array(
@ -152,6 +154,7 @@ class AppController extends Controller {
if (trim($baseurl) == 'http://') {
$this->Server->serverSettingsSaveValue('MISP.baseurl', '');
}
$this->baseurl = $baseurl;
$this->set('baseurl', h($baseurl));
// send users away that are using ancient versions of IE

9
app/Model/Server.php
View File

@ -2480,9 +2480,14 @@ class Server extends AppModel {
public function testBaseURL($value) {
// only run this check via the GUI, via the CLI it won't work
if (php_sapi_name() == 'cli') return true;
if (php_sapi_name() == 'cli') {
if (!preg_match('/^http(s)?:\/\//i', $value)) {
return 'Invalid baseurl, please make sure that the protocol is set.';
}
return true;
}
if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value);
if ($value != strtolower($this->getProto()) . '://' . $this->getHost()) return false;
if ($value != strtolower($this->getProto()) . '://' . $this->getHost()) return 'critical_error##COMMA##block';
return true;
}