Security: Disallow writing temporary files to symlinks (bug #855)

Cc @peterpp

diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php
index ae6153ae01a0e3ae7d5628cc8ea9b0dca3aec995..69229ae315d15d0151bb1d159b732e4a4c16ef6c 100644 (file)
--- a/adminer/include/auth.inc.php
+++ b/adminer/include/auth.inc.php
@@ -19,7 +19,17 @@ if ($_COOKIE["adminer_permanent"]) {
 
 function add_invalid_login() {
        global $adminer;
-       $fp = file_open_lock(get_temp_dir() . "/adminer.invalid");
+       $base = get_temp_dir() . "/adminer.invalid";
+       // adminer.invalid may not be writable by us, try the files with random suffixes
+       foreach (glob("$base*") ?: array($base) as $filename) {
+               $fp = file_open_lock($filename);
+               if ($fp) {
+                       break;
+               }
+       }
+       if (!$fp) {
+               $fp = file_open_lock("$base-" . rand_string());
+       }
        if (!$fp) {
                return;
        }
@@ -42,7 +52,15 @@ function add_invalid_login() {
 
 function check_invalid_login() {
        global $adminer;
-       $invalids = unserialize(@file_get_contents(get_temp_dir() . "/adminer.invalid")); // @ - may not exist
+       $invalids = array();
+       foreach (glob(get_temp_dir() . "/adminer.invalid*") as $filename) {
+               $fp = file_open_lock($filename);
+               if ($fp) {
+                       $invalids = unserialize(stream_get_contents($fp));
+                       file_unlock($fp);
+                       break;
+               }
+       }
        $invalid = ($invalids ? $invalids[$adminer->bruteForceKey()] : array());
        $next_attempt = ($invalid[1] > 29 ? $invalid[0] - time() : 0); // allow 30 invalid attempts
        if ($next_attempt > 0) { //! do the same with permanent login

diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php
index a5ab480ac2520192f03dcbfe397b82b9ccaebe4a..18152ab03a079c999ac35e42b4a25e707eef11a3 100644 (file)
--- a/adminer/include/functions.inc.php
+++ b/adminer/include/functions.inc.php
@@ -799,6 +799,9 @@ function get_temp_dir() {
 * @return resource or null for error
 */
 function file_open_lock($filename) {
+       if (is_link($filename)) {
+               return; // https://cwe.mitre.org/data/definitions/61.html
+       }
        $fp = @fopen($filename, "c+"); // @ - may not be writable
        if (!$fp) {
                return;

diff --git a/changes.txt b/changes.txt
index c8eea2db85e4cb6138edc9d3bd9deed6e090a7d8..9f4b804ea4c9e64ea6bf908f1a74400e43c9c2e8 100644 (file)
--- a/changes.txt
+++ b/changes.txt
@@ -2,6 +2,7 @@ Adminer dev:
 Align numbers right (bug #912)
 Remember export setting at SQL command
 SQL textarea: Open help on Ctrl+click
+Security: Disallow writing temporary files to symlinks (bug #855)
 MariaDB: Display MariaDB instead of MySQL
 CSS: Dark mode syntax highlighting
 Designs named adminer-dark.css use dark basic style