WR #490867 auth_outage Review changes - sanitise header metadata and file request parameters, restrict served mime types, guard warning bar css output, move svgicons config change out of constructor, add missing form field types

classes/form/outage/edit.php

@@ -67,6 +67,7 @@ class edit extends moodleform {
         $mform->addHelpButton('title', 'title', 'auth_outage');
 
         $mform->addElement('editor', 'description', get_string('description', 'auth_outage'));
+        $mform->setType('description[text]', PARAM_RAW);
         $mform->addHelpButton('description', 'description', 'auth_outage');
 
         $mform->addElement('static', 'usagehints', '', get_string('textplaceholdershint', 'auth_outage'));
@@ -79,6 +80,7 @@ class edit extends moodleform {
             get_string('useaccesskey:desc', 'auth_outage'),
             0
         );
+        $mform->setType('useaccesskey', PARAM_BOOL);
 
         $mform->addElement('text', 'accesskey', get_string('accesskey', 'auth_outage'));
         $mform->setType('accesskey', PARAM_TEXT);

classes/local/controllers/infopage.php

@@ -47,11 +47,6 @@ class infopage {
      * @param array|null $params Parameters to use or null to get from Moodle API (request).
      */
     public function __construct(?array $params = null) {
-        global $CFG;
-        // Enable SVG support here to make sure all SVG files
-        // used in the current theme are served properly.
-        $CFG->svgicons = true;
-
         if (is_null($params)) {
             $params = [
                 'id' => optional_param('id', null, PARAM_INT),
@@ -92,6 +87,10 @@ class infopage {
      */
     public function output() {
         global $PAGE, $CFG, $OUTPUT;
+        // Enable SVG support here to make sure all SVG files
+        // used in the current theme are served properly.
+        $previoussvg = $CFG->svgicons ?? null;
+        $CFG->svgicons = true;
 
         if (is_null($this->outage)) {
             redirect(new moodle_url('/'));
@@ -111,7 +110,8 @@ class infopage {
 
         // Inject metadata into the header before output.
         if (!empty($this->outage->metadata)) {
-            header('X-Outage-Metadata: ' . $this->outage->metadata);
+            $safemeta = str_replace(["\r", "\n"], '', $this->outage->metadata);
+            header('X-Outage-Metadata: ' . $safemeta);
             header('X-Outage-StartTime: ' . $this->outage->starttime);
             header('X-Outage-EndTime: ' . $this->outage->stoptime);
         }
@@ -127,6 +127,7 @@ class infopage {
         if (!($CFG->branch == '27' && CLI_SCRIPT)) {
             echo $OUTPUT->footer();
         }
+        $CFG->svgicons = $previoussvg;
     }
 
     /**

classes/local/controllers/maintenance_static_page.php

@@ -51,7 +51,8 @@ class maintenance_static_page {
         } else {
             // Inject metadata into the header before output.
             if (!empty($outage->metadata)) {
-                header('X-Outage-Metadata: ' . $outage->metadata);
+                $safemeta = str_replace(["\r", "\n"], '', $outage->metadata);
+                header('X-Outage-Metadata: ' . $safemeta);
                 header('X-Outage-StartTime: ' . $outage->starttime);
                 header('X-Outage-EndTime: ' . $outage->stoptime);
             }

file.php

@@ -37,14 +37,31 @@ if (!isset($_GET['file'])) {
     die('Missing file parameter.');
 }
 
-$parts = explode('.', $_GET['file']);
+$rawfile = $_GET['file'];
+if (!preg_match('/^[a-zA-Z0-9_\-\.\/]+$/', $rawfile)) {
+    http_response_code(400);
+    die('Invalid file parameter.');
+}
+
+$parts = explode('.', $rawfile);
 if (count($parts) != 2) {
     http_response_code(400);
     die('Invalid file requested.');
 }
-$mime = base64_decode($parts[1]);
+$extension = strtolower(pathinfo($parts[0], PATHINFO_EXTENSION));
+$allowedmimes = [
+    'css'  => 'text/css',
+    'png'  => 'image/png',
+    'jpg'  => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif'  => 'image/gif',
+];
+if (!array_key_exists($extension, $allowedmimes)) {
+    http_response_code(400);
+    die('Unsupported file type.');
+}
+$mime = $allowedmimes[$extension];
 
-// Detect type, we only support css or PNG images.
 header('Content-Type: ' . $mime);
 
 // Use cache.

views/warningbar/warningbar.php

@@ -68,7 +68,7 @@ if (!$viewbag['static']) {
     <style>
         <?php
             readfile($CFG->dirroot . '/auth/outage/views/warningbar/warningbar.css');
-            echo outagelib::get_config()->css;
+            echo preg_replace('/<\s*\/\s*style\s*>/i', '', outagelib::get_config()->css);
         ?>
     </style>