From 7cfc539ce92bea8a4c7cfe3068b9e46384ee2e90 Mon Sep 17 00:00:00 2001
From: Taras Machyshyn <taras@letrium.com>
Date: Thu, 9 Oct 2014 13:11:25 +0300
Subject: [PATCH] installer: security improvements

---
 install/core/SystemHelper.php              |  4 ++
 install/core/Utils.php                     | 46 ++++++++++++++++++++++
 install/core/actions/errors.php            |  6 +--
 install/core/actions/setupConfirmation.php | 10 ++---
 install/core/tpl/errors.tpl                |  2 +
 install/index.php                          | 27 +++++++------
 install/js/install.js                      | 34 ++++++++--------
 7 files changed, 91 insertions(+), 38 deletions(-)
 create mode 100644 install/core/Utils.php

diff --git a/install/core/SystemHelper.php b/install/core/SystemHelper.php
index c39dcf6277..187e493ef6 100644
--- a/install/core/SystemHelper.php
+++ b/install/core/SystemHelper.php
@@ -122,6 +122,10 @@ class SystemHelper extends \Espo\Core\Utils\System
 
 	protected function getMysqlSetting($name, \PDO $pdoConnection)
 	{
+		if (!method_exists($pdoConnection, 'prepare')) {
+			return null;
+		}
+
 		$sth = $pdoConnection->prepare("SHOW VARIABLES LIKE '" . $name . "'");
 		$sth->execute();
 		$res = $sth->fetch(PDO::FETCH_NUM);
diff --git a/install/core/Utils.php b/install/core/Utils.php
new file mode 100644
index 0000000000..164a07e9bc
--- /dev/null
+++ b/install/core/Utils.php
@@ -0,0 +1,46 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014  Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ ************************************************************************/
+
+class Utils
+{
+	static public $actionPath = 'install/core/actions';
+
+	static public function isActionExists($actionName)
+	{
+		$actionPath = static::$actionPath;
+		$actionFileName = $actionName . '.php';
+		$actionRealPath = realpath($actionPath . '/' . $actionFileName);
+
+		$fileManager = new \Espo\Core\Utils\File\Manager();
+		$actionList = $fileManager->getFileList($actionPath);
+
+		foreach ($actionList as $fileName) {
+			$fileRealPath = realpath($actionPath . '/' . $fileName);
+
+			if ($fileRealPath === $actionRealPath) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+}
\ No newline at end of file
diff --git a/install/core/actions/errors.php b/install/core/actions/errors.php
index d6473a18f9..1ca3efe6ed 100644
--- a/install/core/actions/errors.php
+++ b/install/core/actions/errors.php
@@ -20,8 +20,4 @@
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
  ************************************************************************/
 
-$errors = array();
-if (!empty($_REQUEST['desc'])) {
-	$errors = str_replace('^^', '<br>', $_REQUEST['desc']);
-	$smarty->assign('errors', $errors);
-}
\ No newline at end of file
+
diff --git a/install/core/actions/setupConfirmation.php b/install/core/actions/setupConfirmation.php
index fa9b28d3bf..c5edb20093 100644
--- a/install/core/actions/setupConfirmation.php
+++ b/install/core/actions/setupConfirmation.php
@@ -24,18 +24,18 @@ $phpConfig = $systemHelper->getRecommendationList();
 $smarty->assign('phpConfig', $phpConfig);
 
 $installData = $_SESSION['install'];
-list($host, $port) = explode(':', $installData['hostName']);
+list($host, $port) = explode(':', $installData['host-name']);
 
 $dbConfig = array(
     'dbHostName' => $host,
     'dbPort' => $port,
-    'dbName' => $installData['dbName'],
-    'dbUserName' => $installData['dbUserName'],
-    'dbUserPass' => $installData['dbUserPass'],
+    'dbName' => $installData['db-name'],
+    'dbUserName' => $installData['db-user-name'],
+    'dbUserPass' => $installData['db-user-password'],
 );
 $mysqlConfig = $systemHelper->getRecommendationList('mysql', $dbConfig);
 
-$dbConfig['dbHostName'] = $installData['hostName'];
+$dbConfig['dbHostName'] = $installData['host-name'];
 unset($dbConfig['dbPort'], $dbConfig['dbUserPass']);
 
 foreach ($dbConfig as $name => $value) {
diff --git a/install/core/tpl/errors.tpl b/install/core/tpl/errors.tpl
index da505006dc..0a9ca49378 100644
--- a/install/core/tpl/errors.tpl
+++ b/install/core/tpl/errors.tpl
@@ -27,6 +27,8 @@
 		}
 	{literal}
 		var installScript = new InstallScript(opt);
+		installScript.showLoading();
+		installScript.actionsChecking();
 	})
 	{/literal}
 </script>
diff --git a/install/index.php b/install/index.php
index 3fdba9b1f1..17154f899e 100644
--- a/install/index.php
+++ b/install/index.php
@@ -24,14 +24,21 @@ session_start();
 
 require_once('../bootstrap.php');
 
+//action
+$action = (!empty($_POST['action']))? $_POST['action'] : 'main';
+require_once('core/Utils.php');
+if (!Utils::isActionExists($action)) {
+	die('This page does not exist.');
+}
 
 // temp save all settings
-$ignore = array('desc', 'dbName', 'hostName', 'dbUserName', 'dbUserPass', 'dbDriver');
+$ignoredFields = array('installProcess', 'dbName', 'hostName', 'dbUserName', 'dbUserPass', 'dbDriver');
 
-if (!empty($_REQUEST)) {
-	foreach ($_REQUEST as $key => $val) {
-		if (!in_array($val, $ignore))
-		$_SESSION['install'][$key] = trim($val);
+if (!empty($_POST)) {
+	foreach ($_POST as $key => $val) {
+		if (!in_array($key, $ignoredFields)) {
+			$_SESSION['install'][$key] = trim($val);
+		}
 	}
 }
 
@@ -59,6 +66,7 @@ if (!$systemHelper->initWritable()) {
 require_once ('install/vendor/smarty/libs/Smarty.class.php');
 
 require_once 'core/Installer.php';
+require_once 'core/Utils.php';
 
 $smarty = new Smarty();
 $installer = new Installer();
@@ -85,11 +93,6 @@ $smarty->assign("langs", $langs);
 $smarty->assign("langsJs", json_encode($langs));
 
 // include actions and set tpl name
-$tplName = 'main.tpl';
-$actionsDir = 'core/actions';
-$actionFile = '';
-$action = (!empty($_REQUEST['action']))? $_REQUEST['action'] : 'main';
-
 switch ($action) {
 	case 'main':
 		$languageList = $installer->getLanguageList();
@@ -119,7 +122,7 @@ switch ($action) {
 		break;
 }
 
-$actionFile = $actionsDir.'/'.$action.'.php';
+$actionFile = 'core/actions/'.$action.'.php';
 $tplName = $action.'.tpl';
 $smarty->assign('tplName', $tplName);
 $smarty->assign('action', ucfirst($action));
@@ -128,7 +131,7 @@ $smarty->assign('action', ucfirst($action));
 $config = include('core/config.php');
 $smarty->assign('config', $config);
 
-if (!empty($actionFile) && file_exists('install/'.$actionFile)) {
+if (Utils::isActionExists($action)) {
 	include $actionFile;
 }
 
diff --git a/install/js/install.js b/install/js/install.js
index 95ecdab2d6..171ff4ec0f 100644
--- a/install/js/install.js
+++ b/install/js/install.js
@@ -514,18 +514,12 @@ InstallScript.prototype.validate = function() {
 	return valid;
 }
 
-
 InstallScript.prototype.setForm = function(opt) {
 	var formId = opt.formId || 'nav';
 	var action = opt.action || 'main';
-	var desc = opt.desc || '';
 
 	var actionField = $('<input>', {'name': 'action', 'value': action, 'type': 'hidden'});
 	$('#'+formId).append(actionField);
-	var descField = $('<textarea>', {'name': 'desc', 'value': action, 'type': 'hidden'});
-	descField.val(desc);
-	descField.css('display', 'none');
-	$('#'+formId).append(descField);
 
 	$('#'+formId).attr('method', 'POST');
 }
@@ -648,7 +642,6 @@ InstallScript.prototype.checkAction = function(dataMain) {
 	})
 }
 
-
 InstallScript.prototype.checkModRewrite = function() {
 	var self = this;
 	this.modRewriteUrl;
@@ -681,11 +674,8 @@ InstallScript.prototype.callbackModRewrite = function(data) {
 	}
 
 	ajaxData.success = false;
-	if (typeof(this.langs) !== 'undefined') {
-		ajaxData.errorMsg = (typeof(this.langs['options']['modRewriteHelp'][this.serverType]) !== 'undefined')? this.langs['options']['modRewriteHelp'][this.serverType] : this.langs['options']['modRewriteHelp']['default'];
-		ajaxData.errorMsg += (typeof(this.langs['options']['modRewriteInstruction'][this.serverType]) !== 'undefined' && typeof(this.langs['options']['modRewriteInstruction'][this.serverType][this.OS]) !== 'undefined') ? this.langs['options']['modRewriteInstruction'][this.serverType][this.OS] : '';
-		ajaxData.errorMsg = ajaxData.errorMsg.replace("{ESPO_PATH}", this.getEspoPath(true)).replace("{API_PATH}", this.apiPath).replace("{API_PATH}", this.apiPath);
-	}
+	ajaxData.errorMsg = this.getModRewriteErrorMesssage();
+
 	var realCheckIndex = this.checkIndex - 1;
 	if (typeof(this.checkActions[realCheckIndex]) != 'undefined'
 		&& typeof(this.checkActions[realCheckIndex].break) != 'undefined') {
@@ -705,14 +695,14 @@ InstallScript.prototype.callbackChecking = function(data) {
 		this.goTo('step3');
 	}
 	else {
-		var desc = (typeof(data.errorMsg))? data.errorMsg : '';
-		desc += (typeof(data.errorFixInstruction) != 'undefined')? data.errorFixInstruction : '';
+		var errorMsg = (typeof(data.errorMsg))? data.errorMsg : '';
+		errorMsg += (typeof(data.errorFixInstruction) != 'undefined')? data.errorFixInstruction : '';
 		if (this.reChecking) {
-			this.showMsg({msg: desc, error: true});
+			this.showMsg({msg: errorMsg, error: true});
 			$("#re-check").removeAttr('disabled');
 		}
 		else {
-			this.setForm({action: 'errors', desc: desc});
+			this.setForm({action: 'errors'});
 			$('#nav').submit();
 		}
 	}
@@ -732,6 +722,18 @@ InstallScript.prototype.getEspoPath = function(onlyPath) {
 	return location;
 }
 
+InstallScript.prototype.getModRewriteErrorMesssage = function() {
+
+	var message = '';
+	if (typeof(this.langs) !== 'undefined') {
+		message = (typeof(this.langs['options']['modRewriteHelp'][this.serverType]) !== 'undefined')? this.langs['options']['modRewriteHelp'][this.serverType] : this.langs['options']['modRewriteHelp']['default'];
+		message += (typeof(this.langs['options']['modRewriteInstruction'][this.serverType]) !== 'undefined' && typeof(this.langs['options']['modRewriteInstruction'][this.serverType][this.OS]) !== 'undefined') ? this.langs['options']['modRewriteInstruction'][this.serverType][this.OS] : '';
+		message = message.replace("{ESPO_PATH}", this.getEspoPath(true)).replace("{API_PATH}", this.apiPath).replace("{API_PATH}", this.apiPath);
+	}
+
+	return message;
+}
+
 InstallScript.prototype.goToEspo = function() {
 
 	var location = this.getEspoPath();