#5035 Security enhancements

inc/classes/BxDolRequest.php

@@ -132,11 +132,15 @@ class BxDolRequest extends BxDol
         else if(!$bMethod && !$bTerminateOnError)
             return false;
     }
+
     protected static function _require($aModule, $sClass)
     {
         if(isset($GLOBALS['bxDolClasses'][$sClass]))
             return $GLOBALS['bxDolClasses'][$sClass];
 
+        if (!preg_match('/^[A-Za-z0-9_]+\/[A-Za-z0-9_]+$/', $aModule['path']) || !preg_match('/^[A-Za-z0-9_]+$/', $sClass))
+            return false;
+
         if($aModule['path']) {
             $sFile = BX_DIRECTORY_PATH_MODULES . $aModule['path'] . 'classes/' . $sClass . '.php';
             if(!file_exists($sFile))

modules/boonex/dolphin_migration/classes/BxMDb.php

@@ -159,7 +159,7 @@ class BxMDb
             $sOutput .= '<div><b>Settings:</b></div><div style="overflow:scroll;height:300px;border:1px solid gray;"><pre>' . htmlspecialchars_adv($sSettings) . '</pre></div>';
         }
 
-        $sOutput .= '<p><b>Called script:</b><br />' . $_SERVER['PHP_SELF'] . '</p>';
+        $sOutput .= '<p><b>Called script:</b><br />' . htmlspecialchars_adv($_SERVER['PHP_SELF']) . '</p>';
 
         if(!empty($_REQUEST)) {
             $sRequest = var_export($_REQUEST, true);

modules/boonex/oauth2/classes/BxOAuthAPI.php

@@ -310,8 +310,6 @@ class BxOAuthAPI extends BxDol
 
         if (!($aParams = bx_get('params')))
             $aParams = array();
-        elseif (is_string($aParams) && preg_match('/^a:[\d+]:\{/', $aParams))
-            $aParams = @unserialize($aParams);
         elseif (is_string($aParams) && preg_match('/^\[.*\]$/', $aParams))
             $aParams = @json_decode($aParams);
         if (!is_array($aParams))
@@ -320,6 +318,11 @@ class BxOAuthAPI extends BxDol
         if (!($sClass = bx_get('class')))
             $sClass = 'Module';
 
+        if (!preg_match('/^[A-Za-z0-9_]+$/', $sModule) || !preg_match('/^[A-Za-z0-9_]+$/', $sMethod) || !preg_match('/^[A-Za-z0-9_]+$/', $sClass)) {
+            $this->errorOutput(500, 'error', 'Malformed request');
+            return false;
+        }
+
         if (!BxDolRequest::serviceExists($sModule, $sMethod, $sClass)) {
             $this->errorOutput(404, 'not_found', 'Service was not found');
             return false;

modules/boonex/payment/classes/BxPaymentCart.php

@@ -209,7 +209,7 @@ class BxPaymentCart extends BxBaseModPaymentCart
         if($sCartItemsResult === false) {            
         if(strpos($sCartItems, $sCiDsc) !== false)
                 $sCartItemsResult = preg_replace_callback(
-                "/" . $this->_oModule->_oConfig->descriptorA2S(array($iSellerId, $iModuleId, $iItemId, '([0-9]+)')) . "/", function($aMatches) use($iSellerId, $iModuleId, $iItemId, $iItemCount) {
+                "/" . $this->_oModule->_oConfig->descriptorA2S(array(preg_quote($iSellerId, '/'), preg_quote($iModuleId, '/'), preg_quote($iItemId, '/'), '([0-9]+)')) . "/", function($aMatches) use($iSellerId, $iModuleId, $iItemId, $iItemCount) {
                     return $this->_oModule->_oConfig->descriptorA2S(array($iSellerId, $iModuleId, $iItemId, $aMatches[1] + $iItemCount));
                 },
             	$sCartItems
@@ -288,7 +288,7 @@ class BxPaymentCart extends BxBaseModPaymentCart
             $iModuleId = $iItemId = '[0-9\-]+';
         }
 
-        $aCart['items'] = trim(preg_replace("'" . $this->_oModule->_oConfig->descriptorA2S(array($iSellerId, $iModuleId, $iItemId, '[0-9]+:?')) . "'", "", $aCart['items']), ":");
+        $aCart['items'] = trim(preg_replace("'" . $this->_oModule->_oConfig->descriptorA2S(array(preg_quote($iSellerId, "'"), preg_quote($iModuleId, "'"), preg_quote($iItemId, "'"), '[0-9]+:?')) . "'", "", $aCart['items']), ":");
         $this->_oModule->_oDb->setCartItems($iClientId, $aCart['items'], $aCartCustom);
 
         $this->_oModule->alert('delete_from_cart', 0, 0, array(
@@ -339,7 +339,7 @@ class BxPaymentCart extends BxBaseModPaymentCart
             if(empty($aItemInfo) || !is_array($aItemInfo)) {
                 if($bTypeSingle) {
                     $sCartItems = $this->_oModule->_oDb->getCartItems($iClientId);
-                    $sCartItems = trim(preg_replace("'" . $this->_oModule->_oConfig->descriptorA2S($aItem) . ":?'", "", $sCartItems), ":");
+                    $sCartItems = trim(preg_replace("'" . preg_quote($this->_oModule->_oConfig->descriptorA2S($aItem), "'") . ":?'", "", $sCartItems), ":");
                     $this->_oModule->_oDb->setCartItems($iClientId, $sCartItems);
                 }
 

studio/classes/BxDolStudioModule.php

@@ -122,7 +122,7 @@ class BxDolStudioModule extends BxTemplStudioWidget
                 if(empty($sValue))
                     break;
 
-                $iWidgetId = bx_process_input(bx_get($this->sParamPrefix . '_widget_id'), BX_DATA_INT);
+                $iWidgetId = (int)bx_get($this->sParamPrefix . '_widget_id');
 
                 $aResult = $this->activate($sValue, $iWidgetId);
                 break;