summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authordsnopek2018-10-03 21:21:02 (GMT)
committerDavid Snopek2018-10-03 21:21:02 (GMT)
commit559b9143c125607d340400571c56d28089a0db7e (patch)
tree2c9230b20064ac92d6b7ed5c50bbd9a72b9c3f47
parentf5f28ec21b821947fdaef0fc805881e91868a069 (diff)
Issue #3004166 by dsnopek: [print] Add D6LTS patch for SA-CONTRIB-2018-063
-rw-r--r--common/contrib/print/SA-CONTRIB-2018-063.patch35
1 files changed, 35 insertions, 0 deletions
diff --git a/common/contrib/print/SA-CONTRIB-2018-063.patch b/common/contrib/print/SA-CONTRIB-2018-063.patch
new file mode 100644
index 0000000..67902dc
--- /dev/null
+++ b/common/contrib/print/SA-CONTRIB-2018-063.patch
@@ -0,0 +1,35 @@
+diff --git a/print_pdf/print_pdf.pages.inc b/print_pdf/print_pdf.pages.inc
+index 1f1fb92..6999cb8 100644
+--- a/print_pdf/print_pdf.pages.inc
++++ b/print_pdf/print_pdf.pages.inc
+@@ -110,6 +110,9 @@ function print_pdf_generate_path($path, $cid = NULL, $pdf_filename = NULL) {
+ function print_pdf_generate_html($print, $html, $filename = NULL) {
+ $print_pdf_pdf_tool = variable_get('print_pdf_pdf_tool', PRINT_PDF_PDF_TOOL_DEFAULT);
+
++ // Remove all scripts due to security concerns.
++ $html = preg_replace('!<script(.*?)>(.*?)</script>!is', '', $html);
++
+ if (basename($print_pdf_pdf_tool) == 'dompdf_config.inc.php') {
+ return _print_pdf_dompdf($print, $html, $filename);
+ }
+@@ -380,8 +383,8 @@ function _print_pdf_tcpdf($print, $html, $filename = NULL) {
+ */
+ function _print_pdf_wkhtmltopdf($print, $html, $filename = NULL) {
+ $print_pdf_pdf_tool = variable_get('print_pdf_pdf_tool', PRINT_PDF_PDF_TOOL_DEFAULT);
+- $print_pdf_paper_size = variable_get('print_pdf_paper_size', PRINT_PDF_PAPER_SIZE_DEFAULT);
+- $print_pdf_page_orientation = variable_get('print_pdf_page_orientation', PRINT_PDF_PAGE_ORIENTATION_DEFAULT);
++ $print_pdf_paper_size = escapeshellarg(variable_get('print_pdf_paper_size', PRINT_PDF_PAPER_SIZE_DEFAULT));
++ $print_pdf_page_orientation = escapeshellarg(variable_get('print_pdf_page_orientation', PRINT_PDF_PAGE_ORIENTATION_DEFAULT));
+ $print_pdf_content_disposition = variable_get('print_pdf_content_disposition', PRINT_PDF_CONTENT_DISPOSITION_DEFAULT);
+ $print_pdf_wkhtmltopdf_options = variable_get('print_pdf_wkhtmltopdf_options', PRINT_PDF_WKHTMLTOPDF_OPTIONS);
+
+@@ -391,6 +394,9 @@ function _print_pdf_wkhtmltopdf($print, $html, $filename = NULL) {
+ $print_pdf_wkhtmltopdf_options = token_replace($print_pdf_wkhtmltopdf_options, 'node', $print['node'], TOKEN_PREFIX, TOKEN_SUFFIX, array('clear' => TRUE));
+ }
+
++ // Prevent options that could result in execution of arbitrary commands.
++ $wkhtmltopdf_options = escapeshellcmd($wkhtmltopdf_options);
++
+ $version = _print_pdf_wkhtmltopdf_version();
+
+ // 0.10.0 beta2 identifies itself as 0.9.9