Version 2.2.0 RC-1

upload/sources/lib/tar.php

@@ -2,28 +2,18 @@
 
 /*
 +--------------------------------------------------------------------------
-|   Invision Power Board 2.1.7
+|   Invision Power Board
 |   =============================================
 |   by Matthew Mecham
-|   (c) 2001 - 2005 Invision Power Services, Inc.
+|   (c) 2001 - 2006 Invision Power Services, Inc.
 |   http://www.invisionpower.com
 |   =============================================
 |   Web: http://www.invisionboard.com
-|        http://www.ibresource.ru/products/invisionpowerboard/
-|   Time: Tuesday 18th of July 2006 05:56:00 PM
-|   Release: 52f408a29988b02f45b5e6f4ba5af0ae
 |   Licence Info: http://www.invisionboard.com/?license
-|                 http://www.ibresource.ru/license
 +---------------------------------------------------------------------------
-|   INVISION POWER BOARD IS NOT FREE / OPEN SOURCE!
-+---------------------------------------------------------------------------
-|   INVISION POWER BOARD ÍÅ ßÂËßÅÒÑß ÁÅÑÏËÀÒÍÛÌ ÏÐÎÃÐÀÌÌÍÛÌ ÎÁÅÑÏÅ×ÅÍÈÅÌ!
-|   Ïðàâà íà ÏÎ ïðèíàäëåæàò Invision Power Services
-|   Ïðàâà íà ïåðåâîä IBResource (http://www.ibresource.ru)
-+---------------------------------------------------------------------------
-|   > $Date: 2005-12-01 16:45:12 +0000 (Thu, 01 Dec 2005) $
-|   > $Revision: 88 $
-|   > $Author: bfarber $
+|   > $Date: 2006-10-03 12:14:55 +0100 (Tue, 03 Oct 2006) $
+|   > $Revision: 596 $
+|   > $Author: matt $
 +---------------------------------------------------------------------------
 |
 |   > Tar creation and extraction module
@@ -66,6 +56,11 @@
 *************************************************************/
 
 
+if ( ! defined( 'IN_IPB' ) )
+{
+	print "<h1>Incorrect access</h1>You cannot access this file directly. If you have recently upgraded, make sure you upgraded 'admin.php'.";
+	exit();
+}
 
 class tar {
 	
@@ -91,17 +86,17 @@ class tar {
 	// CONSTRUCTOR: Attempt to guess the current working dir.
 	//-----------------------------------------
 	
-	function tar_init() {
-		
+	function tar_init()
+	{
 		$this->ipsclass->load_language('lang_tar');
 		
-		if ($this_dir = getcwd())
+		if ( $this_dir == getcwd() )
 		{
 			$this->current_dir = $this_dir;
 		}
-		else if (isset($_SERVER['DOCUMENT_ROOT']))
+		else if ( $this->ipsclass->my_getenv( 'DOCUMENT_ROOT' ) )
 		{
-			$this->current_dir = $_SERVER['DOCUMENT_ROOT'];
+			$this->current_dir = $this->ipsclass->my_getenv( 'DOCUMENT_ROOT' );
 		}
 		else
 		{
@@ -316,13 +311,19 @@ class tar {
 			return;
 		}
 		
-		foreach ($in_files as $k => $file) {
-		
+		foreach ($in_files as $file)
+		{
+			//-----------------------------------------
+			// Stop any potential file traversal issues
+			//-----------------------------------------
+			
+			$file['name'] = str_replace( '..', '', $file['name'] );
+			
 			//-----------------------------------------
 			// Are we choosing which files to extract?
 			//-----------------------------------------
 			
-			if (is_array($files))
+			if ( is_array($files) )
 			{
 				if (! in_array($file['name'], $files) )
 				{
@@ -341,7 +342,8 @@ class tar {
 			{
 				$path_info = explode( "/" , $file['name'] );
 				$file_name = array_pop($path_info);
-			} else
+			}
+			else
 			{
 				$path_info = array();
 				$file_name = $file['name'];