平面文件CMS（PAAS）的安全性

Question

I am building a flat file cms that uses php files. Users will be able to rename files using an input field and the old and new file paths will be sent via ajax to the server where I test for security. I realize this could be done easier with regex or even OR operators. I took the OR operators out so that the strings would not be too long for this post. And as for regex, I'd like more control over the errors I send back to the client.

The CMS itself is much like a PAAS that resides in directory above all of the individual site folders that each user will have. My goal is to keep users from injecting code that might interfere with other (adjacent) user folders or the cms itself in the parent directory above.

I have not parsed the path's yet for validity. I am just trying to get an idea of how a malicious user might be able to take advantage of what I have written so far.

<?php
 $old_path = $_POST['file'].'.php'; // path/to/file.php
 $new_path = $_POST['new_file'].'.php'; // path/to/newfile.php';
  if(strstr($new_path,"<?")){
    echo "Sorry, path cannot contain script tags";
  }elseif(strstr($new_path,"?>")){
    echo "Sorry, path cannot contain script tags";
  }elseif (strstr($new_path,">")){
    echo "Sorry, path cannot contain script tags";
  }elseif (strstr($new_path,"<")){
    echo "Sorry, path cannot contain script tags";    
  }elseif($new_path[0]==="." OR $new_path[0]==='/' OR $new_path[0]==='\\'){
    echo 'Sorry first character of path cannot be a period or slash';
  }else{

    //this is set when the user logs in based on details in a database
    $users_dedicated_directory = $_SESSION['userfolder'].'/';

    // add the users folder when renaming just for more control
    $old_path = $users_dedicated_directory.$old_path;

    // add the users folder when renaming just for more control
    $new_path = $users_dedicated_directory.$old_path;

    rename($old_path,$new_path);

    //trim the users folder name. Send it back to the client  
    echo explode($users_dedicated_directory,$new_path);    
   }   
?>

Answer 1

if new_path is something like a/../../path/to/one/of/you/cms/core/file.php if think a malicious user could overwrite some files of your CMS.

You'll have to remove write permissions for the web server to nay of your CMS files to prevent that.