Changeset 6714

Timestamp:

Jan 29, 2018, 12:25:07 PM (19 months ago)

Author:

kbut

Message:

Add security to upload file

Location:

lmd/trunk/fuentes/admin-center-ltsp.install

Files:

• adminroot/uploadiso.php (modified) (4 diffs)
• modul/lliurex-ltsp/src/js/imageManager.js (modified) (1 diff)

lmd/trunk/fuentes/admin-center-ltsp.install/adminroot/uploadiso.php

@@ -1 +1 @@
 <?php
+include('./n4d_lib.php');
 class UploadManager{
         const ISOSPATH = "/opt/ltsp/isos/";
@@ -8 +9 @@
         private $FILES;
         
-        function __construct($FILESTOUPLOAD){
+        function __construct($FILESTOUPLOAD,$POST){
                 $this->file_info = pathinfo($FILESTOUPLOAD[self::FORMISONAME]['name']);
                 $this->original_name = $this->file_info['filename'];
                 $this->ext = $this->file_info['extension'];
                 $this->FILES = $FILESTOUPLOAD;
+                $this->user = $POST['user'];
+                $this->password = $POST['password'];
         }
 
@@ -27 +30 @@
         }
         public function save_file(){
+
+                $cliente = new N4D('localhost');
+                try{
+                                $result = $cliente->execute('validate_user',[$this->user,$this->password]);
+                                $groups = array('adm','admin','teachers');
+                                if(!($result[0] && count(array_intersect($result[1],$groups)) >= 1)){
+                                        return array("result"=>"False","msg"=>"");
+                                }
+                }
+                catch (Exception $e){
+                        return array("result"=>"False","msg"=>$e);
+                }
+
                 $target = $this->get_valid_name();
                 $result = ["target"=>$target,"result"=>False];
@@ -35 +51 @@
         }
 }
-$uploadManager = new UploadManager($_FILES);
+$uploadManager = new UploadManager($_FILES,$_POST);
 $result = $uploadManager->save_file();
 

lmd/trunk/fuentes/admin-center-ltsp.install/modul/lliurex-ltsp/src/js/imageManager.js

@@ -1396 +1396 @@
                         var upload_form = new FormData();
                         upload_form.append('isofile',iso_file.files[0]);
+                        upload_form.append('user',sessionStorage.username);
+                        upload_form.append('password',sessionStorage.password);
                         var req = new XMLHttpRequest();
                         var timer;