security issue

ouch!
you are right!

i think this is a drupal bug, because i have no special configs on my web server (apache 1.3.33 on slackware 10.0)

which file is called when i go to:

system/files?

perhaps some drupal module ?

oh! i use mod_rewrite

maybe you get 404 if you don't use it (i guess)

hi,
it can't be Options Indexes, i have Options -Indexes on my virtualhost .htaccess.
i think it can't be neither filesystem problems because i still remain on the drupal wwwroot.
and if i use or not mod_rewrite i can download php file sof my site :-/

hi,
yes i'm on linux :-)

i got this

modules/flexinode/flexinode.module
modules/upload.module
modules/user.module

and after have disabled flexinode i can't get any file via file system.
damned buggyflexi :-/

can you?
:-)

so, lets' go to the flexinode issue archive :-)

thanks for the help! :-)

on includes/file.inc, line 454 :

function file_download() {
$file = $_GET['file'];
if (file_exists(file_create_path($file))) {
$list = module_list();
foreach ($list as $module) {
$headers = module_invoke($module, 'file_download', $file);
if ($headers === -1) {
drupal_access_denied();
}
elseif (is_array($headers)) {
file_transfer($file, $headers);
}
}
}
drupal_not_found();
}

this is the line, i think, to change, IMHO:

if ($headers === -1) // because there is no verification on file extension neither file path

but i'm not able to do it :-)

ok, try this:

file: includes/file.inc
line: 454

function file_download() {
$file = $_GET['file'];
if (file_exists(file_create_path($file))) {
$list = module_list();
foreach ($list as $module) {
$headers = module_invoke($module, 'file_download', $file);
if ($headers === -1) {
drupal_access_denied();
}
elseif (is_array($headers)) {
$file_ext_regex = "^(.*)(php|inc)$";
if ( eregi($file_ext_regex,$file) ) {
@header("Location: /");
exit;
}
file_transfer($file, $headers);
}
}
}
drupal_not_found();
}

just insert this:

$file_ext_regex = "^(.*)(php|inc)$";
if ( eregi($file_ext_regex,$file) ) {
@header("Location: /");
exit;
}

on line 464.
add every file extension you want with (php|inc|some|thing|you|want|to|deny)

i hope will work for everyone.

great :-)

i wonder if there will be some more security options to configure via drupal in the near future :-)

bye

little funny solution:

replace with this the line wih "header..."

@header("Location: " .$base_url. "/error404");

--
tk