myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-28 09:12:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

security: fix unauthenticated file upload/RCE risk, TLS bypass, XSS, and broken gift-card/review columns

Browse Source 
- admin/api/upload-splash.php had NO admin-auth check (included the public
  customer header, not admin/includes/header.php) and both upload endpoints
  trusted the client-supplied MIME type and filename extension, so an
  attacker could name a file "shell.php", spoof Content-Type: image/png,
  and get PHP written into a web-reachable uploads/ directory. Added
  AdminAuth check and centralized real-content validation (getimagesize +
  server-side extension mapping) in a new handleImageUpload() helper used
  by both admin/upload-image.php and admin/api/upload-splash.php.
- Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls
  in includes/email.php and includes/functions.php (MITM risk on the API
  key). Rewrote functions.php's sendEmail() as a thin wrapper around
  Email::send() so there's one implementation instead of two that could
  drift (this is what had the second copy of the TLS bypass).
- Escaped customer-controlled fields (customer_name, tracking info, reset
  URL) before interpolating into outbound HTML emails — name is free text
  from registration/checkout with no length/char restriction, so it was
  stored-HTML-injectable into every transactional email.
- Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column
  on gift_cards (actual column is current_balance) — gift card redemption
  was completely broken, always returning "no remaining balance".
- Fixed api/submit-review.php inserting into nonexistent `content`/`status`
  columns on reviews (actual columns are `comment`/`is_approved`) — review
  submission was crashing on every request.
- Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently
  serves db/schema.sql and the full .git directory (including .git/config,
  which contains a GitHub PAT with push access) over HTTP — the existing
  config/includes RedirectMatch rules are also not being enforced live,
  see report for details; this needs a server-level fix too.
- Cleaned up README's leftover install instructions pointing at a deleted
  create-admin.php with a documented default password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Myron Blair
2026-07-04 14:22:50 -05:00
parent 06260ed192
commit 186ac0cb6d
8 changed files with 123 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/email.php
+11 -11
View File
@@ -75,7 +75,7 @@ class Email {
CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $this->apiKey, 'Content-Type: application/json'],
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYPEER => true,
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
@@ -115,8 +115,8 @@ class Email {
);
}
$html = $this->getTemplate('order_confirmation', [
'order_number' => $order['order_number'],
'customer_name' => $order['customer_name'] ?? 'Valued Customer',
'order_number' => htmlspecialchars($order['order_number']),
'customer_name' => htmlspecialchars($order['customer_name'] ?? 'Valued Customer'),
'items_html' => $itemsHtml,
'subtotal' => formatCurrency($order['subtotal']),
'tax' => formatCurrency($order['tax']),
@@ -136,11 +136,11 @@ class Email {
public function sendShippingNotification(array $order): array {
$html = $this->getTemplate('shipping_notification', [
'order_number' => $order['order_number'],
'customer_name' => $order['customer_name'] ?? 'Valued Customer',
'tracking_number' => $order['tracking_number'],
'tracking_url' => $order['tracking_url'] ?? '#',
'carrier' => $order['shipping_carrier'] ?? 'Our shipping partner'
'order_number' => htmlspecialchars($order['order_number']),
'customer_name' => htmlspecialchars($order['customer_name'] ?? 'Valued Customer'),
'tracking_number' => htmlspecialchars($order['tracking_number']),
'tracking_url' => htmlspecialchars($order['tracking_url'] ?? '#'),
'carrier' => htmlspecialchars($order['shipping_carrier'] ?? 'Our shipping partner')
]);
return $this->send(
$order['customer_email'],
@@ -154,8 +154,8 @@ class Email {
public function sendPasswordReset(string $email, string $resetToken, string $name = ''): array {
$resetUrl = SITE_URL . '/reset-password.php?token=' . $resetToken;
$html = $this->getTemplate('password_reset', [
'customer_name' => $name ?: 'there',
'reset_url' => $resetUrl,
'customer_name' => htmlspecialchars($name ?: 'there'),
'reset_url' => htmlspecialchars($resetUrl),
'expires' => '1 hour'
]);
return $this->send($email, "Reset Your Password - Tom's Java Jive", $html, null, ['tags' => ['password-reset']]);
@@ -163,7 +163,7 @@ class Email {
public function sendWelcome(string $email, string $name = ''): array {
$html = $this->getTemplate('welcome', [
'customer_name' => $name ?: 'Coffee Lover',
'customer_name' => htmlspecialchars($name ?: 'Coffee Lover'),
'shop_url' => SITE_URL . '/shop.php'
]);
return $this->send($email, "Welcome to Tom's Java Jive!", $html, null, ['tags' => ['welcome']]);
includes/functions.php
+61 -23
View File
@@ -349,31 +349,15 @@ function getCartTotal() {
}
/**
* Send email via CyberMail API
* Send email via CyberMail API.
* Thin wrapper around Email::send() (includes/email.php) so there is a
* single implementation of the CyberMail HTTP call, TLS settings, and
* error handling instead of two copies that can drift out of sync.
*/
function sendEmail($to, $subject, $htmlContent, $textContent = '') {
$apiKey = getSetting('cybermail_api_key', defined('CYBERMAIL_API_KEY') ? CYBERMAIL_API_KEY : '');
$from = getSetting('cybermail_from_email', 'noreply@tomsjavajive.com');
$fromName = getSetting('cybermail_from_name', "Tom's Java Jive");
if (!$apiKey) {
error_log('[TJJ sendEmail] CYBERMAIL_API_KEY not configured');
return false;
}
$payload = ['from' => $from, 'from_name' => $fromName, 'to' => $to, 'subject' => $subject, 'html' => $htmlContent];
if ($textContent) $payload['text'] = $textContent;
$ch = curl_init('https://platform.cyberpersons.com/email/v1/send');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($payload),
CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $apiKey, 'Content-Type: application/json'],
CURLOPT_TIMEOUT => 20, CURLOPT_SSL_VERIFYPEER => false,
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpCode === 202) return true;
error_log('[TJJ sendEmail] CyberMail HTTP ' . $httpCode . ' — ' . $response);
return false;
require_once __DIR__ . '/email.php';
$result = emailService()->send($to, $subject, $htmlContent, $textContent ?: null);
return $result['success'] ?? false;
}
/**
@@ -382,3 +366,57 @@ function sendEmail($to, $subject, $htmlContent, $textContent = '') {
function logActivity($action, $details = [], $userId = null) {
// Implement activity logging if needed
}
/**
* Validate and save an uploaded image, verifying the ACTUAL file content
* (not the client-supplied MIME type or filename extension, both of which
* are attacker-controlled) before writing it to disk. Used by every admin
* image-upload endpoint so the checks live in exactly one place.
*
* @param string $fieldName Key in $_FILES to read
* @param string $destDir Absolute directory to save into (created if missing)
* @param string $prefix Filename prefix, e.g. "product_" or "splash_"
* @return array ['success' => bool, 'url' => string, 'path' => string] or ['error' => string]
*/
function handleImageUpload(string $fieldName, string $destDir, string $prefix = 'img_'): array {
if (empty($_FILES[$fieldName]) || $_FILES[$fieldName]['error'] !== UPLOAD_ERR_OK) {
return ['error' => 'No file received'];
}
$file = $_FILES[$fieldName];
if ($file['size'] > MAX_UPLOAD_SIZE) {
return ['error' => 'File too large. Maximum ' . (MAX_UPLOAD_SIZE / (1024 * 1024)) . 'MB.'];
}
// Never trust $file['type'] (client-supplied) or the extension in
// $file['name'] (attacker-supplied) — inspect the real file bytes.
$imageInfo = @getimagesize($file['tmp_name']);
if ($imageInfo === false) {
return ['error' => 'File is not a valid image.'];
}
$extensionByMime = [
'image/jpeg' => 'jpg',
'image/png' => 'png',
'image/gif' => 'gif',
'image/webp' => 'webp',
];
$mime = $imageInfo['mime'];
if (!in_array($mime, ALLOWED_IMAGE_TYPES, true) || !isset($extensionByMime[$mime])) {
return ['error' => 'Invalid file type. Use JPG, PNG, WebP, or GIF.'];
}
if (!is_dir($destDir)) {
mkdir($destDir, 0755, true);
}
$filename = $prefix . time() . '_' . bin2hex(random_bytes(4)) . '.' . $extensionByMime[$mime];
$filepath = rtrim($destDir, '/\\') . '/' . $filename;
if (!move_uploaded_file($file['tmp_name'], $filepath)) {
return ['error' => 'Failed to save file. Check directory permissions.'];
}
return ['success' => true, 'filename' => $filename, 'path' => $filepath];
}