From 08b9f20df1c108be5c1ab8b32c0fcbed31a079b3 Mon Sep 17 00:00:00 2001 From: medhavini Date: Mon, 20 Jul 2015 20:35:39 +0530 Subject: Security check fail Security check condition to check that the path is NOT a URL may give false negative in case of subdomains. Where URLs don't start with http or www. --- system/helpers/path_helper.php | 1 + 1 file changed, 1 insertion(+) (limited to 'system/helpers/path_helper.php') diff --git a/system/helpers/path_helper.php b/system/helpers/path_helper.php index c23ec6435..34eebc4b0 100644 --- a/system/helpers/path_helper.php +++ b/system/helpers/path_helper.php @@ -61,6 +61,7 @@ if ( ! function_exists('set_realpath')) function set_realpath($path, $check_existance = FALSE) { // Security check to make sure the path is NOT a URL. No remote file inclusion! + // PROBLEM HERE - this can be easily bypassed in case of subdomains if (preg_match('#^(http:\/\/|https:\/\/|www\.|ftp|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})#i', $path)) { show_error('The path you submitted must be a local server path, not a URL'); -- cgit v1.2.3-24-g4f1b