File tree Expand file tree Collapse file tree 9 files changed +43
-1
lines changed
lib/Magento/Mtf/Util/Protocol/CurlTransport Expand file tree Collapse file tree 9 files changed +43
-1
lines changed Original file line number Diff line number Diff line change @@ -109,6 +109,7 @@ protected function authorize()
109
109
$ isAuthorized = true ;
110
110
$ _ENV ['app_backend_url ' ] = $ url ;
111
111
break ;
112
+ // phpcs:ignore Magento2.Exceptions.ThrowCatch
112
113
} catch (\Exception $ e ) {
113
114
continue ;
114
115
}
Original file line number Diff line number Diff line change 9
9
*
10
10
* @param string $token
11
11
* @return bool
12
+ *
13
+ * phpcs:disable Squiz.Functions.GlobalFunction
12
14
*/
13
15
function authenticate ($ token )
14
16
{
17
+ // phpcs:ignore Magento2.Security.IncludeFile
15
18
require_once __DIR__ . '/../../../../app/bootstrap.php ' ;
16
19
20
+ // phpcs:ignore Magento2.Security.Superglobal
17
21
$ magentoObjectManagerFactory = \Magento \Framework \App \Bootstrap::createObjectManagerFactory (BP , $ _SERVER );
22
+ // phpcs:ignore Magento2.Security.Superglobal
18
23
$ magentoObjectManager = $ magentoObjectManagerFactory ->create ($ _SERVER );
19
24
$ tokenModel = $ magentoObjectManager ->get (\Magento \Integration \Model \Oauth \Token::class);
20
25
Original file line number Diff line number Diff line change 13
13
14
14
// phpcs:ignore Magento2.Security.Superglobal
15
15
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['command ' ])) {
16
+ // phpcs:ignore Magento2.Security.Superglobal
16
17
if (authenticate (urldecode ($ _POST ['token ' ]))) {
18
+ // phpcs:ignore Magento2.Security.Superglobal
17
19
$ command = urldecode ($ _POST ['command ' ]);
18
20
// phpcs:ignore Magento2.Security.Superglobal
19
21
$ magentoObjectManagerFactory = \Magento \Framework \App \Bootstrap::createObjectManagerFactory (BP , $ _SERVER );
20
22
// phpcs:ignore Magento2.Security.Superglobal
21
23
$ magentoObjectManager = $ magentoObjectManagerFactory ->create ($ _SERVER );
22
24
$ cli = $ magentoObjectManager ->create (\Magento \Framework \Console \Cli::class);
25
+ // phpcs:ignore Magento2.Functions.DiscouragedFunction
23
26
$ input = new StringInput (escapeshellcmd ($ command ));
24
27
$ input ->setInteractive (false );
25
28
$ output = new NullOutput ();
26
29
$ cli ->doRun ($ input , $ output );
27
30
} else {
31
+ // phpcs:ignore Magento2.Security.LanguageConstruct
28
32
echo "Command not unauthorized. " ;
29
33
}
30
34
} else {
35
+ // phpcs:ignore Magento2.Security.LanguageConstruct
31
36
echo "'token' or 'command' parameter is not set. " ;
32
37
}
Original file line number Diff line number Diff line change 6
6
// phpcs:ignore Magento2.Security.IncludeFile
7
7
include __DIR__ . '/authenticate.php ' ;
8
8
9
+ // phpcs:ignore Magento2.Security.Superglobal
9
10
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['path ' ])) {
11
+ // phpcs:ignore Magento2.Security.Superglobal
10
12
if (authenticate (urldecode ($ _POST ['token ' ]))) {
11
13
// phpcs:ignore Magento2.Security.InsecureFunction
12
14
exec ('rm -rf ../../../../generated/* ' );
13
15
} else {
16
+ // phpcs:ignore Magento2.Security.LanguageConstruct
14
17
echo "Command not unauthorized. " ;
15
18
}
16
19
} else {
20
+ // phpcs:ignore Magento2.Security.LanguageConstruct
17
21
echo "'token' parameter is not set. " ;
18
22
}
Original file line number Diff line number Diff line change 6
6
// phpcs:ignore Magento2.Security.IncludeFile
7
7
include __DIR__ . '/authenticate.php ' ;
8
8
9
+ // phpcs:ignore Magento2.Security.Superglobal
9
10
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['template ' ])) {
11
+ // phpcs:ignore Magento2.Security.Superglobal
10
12
if (authenticate (urldecode ($ _POST ['token ' ]))) {
11
- $ varDir = '../../../../var/ ' ;
13
+ $ varDir = '../../../../var/export/ ' ;
14
+ // phpcs:ignore Magento2.Security.Superglobal
12
15
$ template = urldecode ($ _POST ['template ' ]);
13
16
// phpcs:ignore Magento2.Functions.DiscouragedFunction
14
17
$ fileList = scandir ($ varDir , SCANDIR_SORT_NONE );
30
33
// phpcs:ignore Magento2.Security.LanguageConstruct, Magento2.Security.InsecureFunction
31
34
echo serialize ($ files );
32
35
} else {
36
+ // phpcs:ignore Magento2.Security.LanguageConstruct
33
37
echo "Command not unauthorized. " ;
34
38
}
35
39
} else {
40
+ // phpcs:ignore Magento2.Security.LanguageConstruct
36
41
echo "'token' or 'template' parameter is not set. " ;
37
42
}
Original file line number Diff line number Diff line change 6
6
// phpcs:ignore Magento2.Security.IncludeFile
7
7
include __DIR__ . '/authenticate.php ' ;
8
8
9
+ // phpcs:ignore Magento2.Security.Superglobal
9
10
if (!empty ($ _POST ['token ' ])) {
11
+ // phpcs:ignore Magento2.Security.Superglobal
10
12
if (authenticate (urldecode ($ _POST ['token ' ]))) {
13
+ // phpcs:ignore Magento2.Security.Superglobal
11
14
if ($ _POST ['type ' ] == 'deployed ' ) {
15
+ // phpcs:ignore Magento2.Security.Superglobal
12
16
$ themePath = isset ($ _POST ['theme_path ' ]) ? $ _POST ['theme_path ' ] : 'adminhtml/Magento/backend ' ;
13
17
$ directory = __DIR__ . '/../../../../pub/static/ ' . $ themePath ;
18
+ // phpcs:ignore Magento2.Functions.DiscouragedFunction
14
19
$ locales = array_diff (scandir ($ directory ), ['.. ' , '. ' ]);
15
20
} else {
16
21
// phpcs:ignore Magento2.Security.IncludeFile
21
26
// phpcs:ignore Magento2.Security.LanguageConstruct
22
27
echo implode ('| ' , $ locales );
23
28
} else {
29
+ // phpcs:ignore Magento2.Security.LanguageConstruct
24
30
echo "Command not unauthorized. " ;
25
31
}
26
32
} else {
33
+ // phpcs:ignore Magento2.Security.LanguageConstruct
27
34
echo "'token' parameter is not set. " ;
28
35
}
Original file line number Diff line number Diff line change 7
7
// phpcs:ignore Magento2.Security.IncludeFile
8
8
include __DIR__ . '/authenticate.php ' ;
9
9
10
+ // phpcs:ignore Magento2.Security.Superglobal
10
11
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['name ' ])) {
12
+ // phpcs:ignore Magento2.Security.Superglobal
11
13
if (authenticate (urldecode ($ _POST ['token ' ]))) {
14
+ // phpcs:ignore Magento2.Security.Superglobal
12
15
$ name = urldecode ($ _POST ['name ' ]);
13
16
if (preg_match ('/\.\.( \\\|\/)/ ' , $ name )) {
14
17
// phpcs:ignore Magento2.Exceptions.DirectThrow
18
21
// phpcs:ignore Magento2.Security.InsecureFunction, Magento2.Functions.DiscouragedFunction, Magento2.Security.LanguageConstruct
19
22
echo serialize (file_get_contents ('../../../../var/log ' . '/ ' . $ name ));
20
23
} else {
24
+ // phpcs:ignore Magento2.Security.LanguageConstruct
21
25
echo "Command not unauthorized. " ;
22
26
}
23
27
} else {
28
+ // phpcs:ignore Magento2.Security.LanguageConstruct
24
29
echo "'token' or 'name' parameter is not set. " ;
25
30
}
Original file line number Diff line number Diff line change 6
6
// phpcs:ignore Magento2.Security.IncludeFile
7
7
include __DIR__ . '/authenticate.php ' ;
8
8
9
+ // phpcs:ignore Magento2.Security.Superglobal
9
10
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['path ' ])) {
11
+ // phpcs:ignore Magento2.Security.Superglobal
10
12
if (authenticate (urldecode ($ _POST ['token ' ]))) {
13
+ // phpcs:ignore Magento2.Security.Superglobal
11
14
$ path = urldecode ($ _POST ['path ' ]);
12
15
// phpcs:ignore Magento2.Functions.DiscouragedFunction
13
16
if (file_exists ('../../../../ ' . $ path )) {
18
21
echo 'path exists: false ' ;
19
22
}
20
23
} else {
24
+ // phpcs:ignore Magento2.Security.LanguageConstruct
21
25
echo "Command not unauthorized. " ;
22
26
}
23
27
} else {
28
+ // phpcs:ignore Magento2.Security.LanguageConstruct
24
29
echo "'token' or 'path' parameter is not set. " ;
25
30
}
Original file line number Diff line number Diff line change 6
6
// phpcs:ignore Magento2.Security.IncludeFile
7
7
include __DIR__ . '/authenticate.php ' ;
8
8
9
+ // phpcs:ignore Magento2.Security.Superglobal
9
10
if (!empty ($ _POST ['token ' ]) && !empty ($ _POST ['website_code ' ])) {
11
+ // phpcs:ignore Magento2.Security.Superglobal
10
12
if (authenticate (urldecode ($ _POST ['token ' ]))) {
13
+ // phpcs:ignore Magento2.Security.Superglobal
11
14
$ websiteCode = urldecode ($ _POST ['website_code ' ]);
12
15
$ rootDir = '../../../../ ' ;
13
16
$ websiteDir = $ rootDir . 'websites/ ' . $ websiteCode . '/ ' ;
35
38
// phpcs:ignore Magento2.Functions.DiscouragedFunction
36
39
file_put_contents ($ websiteDir . 'index.php ' , $ contents );
37
40
} else {
41
+ // phpcs:ignore Magento2.Security.LanguageConstruct
38
42
echo "Command not unauthorized. " ;
39
43
}
40
44
} else {
45
+ // phpcs:ignore Magento2.Security.LanguageConstruct
41
46
echo "'token' or 'website_code' parameter is not set. " ;
42
47
}
You can’t perform that action at this time.
0 commit comments