openrat-cms

commit 3b406f8f50ff83a51f02675c9c6a1de9743570da
parent 380e9d76e82ebe3a170e842b1573979da2ac9d1a
Author: Jan Dankert <develop@jandankert.de>
Date:   Tue, 18 Aug 2020 23:27:37 +0200

Security: Sanitize user input while logging (no logfile injection with potentially dangerous data)

Diffstat:
modules/cms/Dispatcher.class.php
 | 
2
+-
modules/cms/action/LoginAction.class.php
 | 
4
++--
modules/cms/auth/RememberAuth.class.php
 | 
2
+-
modules/cms/publish/PublishPublic.class.php
 | 
2
+-
modules/logger/Logger.class.php
 | 
16
++++++++++++++++

5 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/modules/cms/Dispatcher.class.php b/modules/cms/Dispatcher.class.php
@@ -158,7 +158,7 @@ class Dispatcher
     {
         global $REQ;
         if (config('security', 'use_post_token') && $_SERVER['REQUEST_METHOD'] == 'POST' && @$REQ[REQ_PARAM_TOKEN] != token()) {
-            Logger::error('Token mismatch: Needed ' . token() . ' but got ' . @$REQ[REQ_PARAM_TOKEN] . '. Maybe an attacker?');
+            Logger::error('Token mismatch: Needed ' . token() . ' but got ' . Logger::sanitizeInput(@$REQ[REQ_PARAM_TOKEN]) . '. Maybe an attacker?');
             throw new SecurityException("Token mismatch");
         }
     }
diff --git a/modules/cms/action/LoginAction.class.php b/modules/cms/action/LoginAction.class.php
@@ -161,7 +161,7 @@ class LoginAction extends BaseAction
 		}
 		else
 		{
-			Logger::info( "login failed for user {$user->name} from IP $ip" );
+			Logger::info( "login failed for user ".Logger::sanitizeInput($user->name)." from IP $ip" );
 
 			return false;
 		}
@@ -790,7 +790,7 @@ class LoginAction extends BaseAction
 		{
 			// Anmeldung nicht erfolgreich
 			
-			Logger::debug("Login failed for user '$loginName' from IP $ip");
+			Logger::debug("Login failed for user ".Logger::sanitizeInput($loginName)." from IP $ip");
 			
 			if	( $tokenFailed )
 			{
diff --git a/modules/cms/auth/RememberAuth.class.php b/modules/cms/auth/RememberAuth.class.php
@@ -31,7 +31,7 @@ class RememberAuth implements Auth
 
 				if (!$dbConfig->has($dbid)) {
 
-					Logger::info('unknown DB-Id for token-login: ' . $dbid);
+					Logger::info('unknown DB-Id for token-login: ' . Logger::sanitizeInput($dbid));
 					return null;
 				}
 
diff --git a/modules/cms/publish/PublishPublic.class.php b/modules/cms/publish/PublishPublic.class.php
@@ -405,7 +405,7 @@ class PublishPublic extends Publish
         {
             $ausgabe = array();
             $rc      = false;
-            Logger::debug('Executing system command: '.$this->commandAfterPublish );
+            Logger::debug('Executing system command: '.Logger::sanitizeInput($this->commandAfterPublish) );
             $user = Session::getUser();
             putenv("CMS_USER_NAME=".$user->name  );
             putenv("CMS_USER_ID="  .$user->userid);
diff --git a/modules/logger/Logger.class.php b/modules/logger/Logger.class.php
@@ -3,6 +3,7 @@
 
 namespace logger;
 use Exception;
+use util\Text;
 
 define('LOGGER_LOG_TRACE', 5);
 define('LOGGER_LOG_DEBUG', 4);
@@ -157,6 +158,21 @@ class Logger
 		if (Logger::$level <= LOGGER_LOG_WARN)
 			error_log($text . "\n");
 	}
+
+
+	/**
+	 * Sanitize user input.
+	 * Cutting out unsafe characters.
+	 *
+	 * @param $input potentially dangerous user input
+	 * @return string a safe representaton of the user input.
+	 */
+	public static function sanitizeInput( $input ) {
+		$length = strlen($input);
+		$white = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.,_-';
+		$clean = Text::clean($input,$white);
+		return '"'.$input.'"/'.$length.'/'.strlen($clean);
+	}
 }
 
 ?> 
\ No newline at end of file