ClicShopping #354

  foreach ($dir_content as $key => $content) {
    $path = $root_dir . DIRECTORY_SEPARATOR . $content;
    if (is_file($path) && is_readable($path)) {
// skip ignored files
      if (!\in_array($content, $ignore_files)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 31 Aug 2023 00:29:47 +0000 by ClicShopping
                    
        if (preg_match($ignore_regex, $content) == 0) {
          $content_chunks = explode(".", $content);
          $ext = $content_chunks[\count($content_chunks) - 1];
// only include files with desired extensions
          if (\in_array($ext, $allow_extensions)) {

        }
      }
    } // if content is a directory and readable, add path and name
    elseif (is_dir($path) && is_readable($path)) {
      // skip any ignored dirs
      if (!\in_array($content, $ignore_dirs)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 31 Aug 2023 00:29:47 +0000 by ClicShopping
                    
// recursive callback to open new directory
        $all_data = get_files($path, $all_data);
      }
    }
  } // end foreach

      if (!\in_array($content, $ignore_files)) {
        if (preg_match($ignore_regex, $content) == 0) {
          $content_chunks = explode(".", $content);
          $ext = $content_chunks[\count($content_chunks) - 1];
// only include files with desired extensions
          if (\in_array($ext, $allow_extensions)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 31 Aug 2023 00:29:47 +0000 by ClicShopping
                    
// save file name with path
            $all_data[] = $path;
          }
        }
      }

    $file_array = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($template_directory));
    foreach ($file_array as $filename => $current) {
      $fileInfo = pathinfo($current->getFileName());
      if (array_key_exists('extension', $fileInfo) && in_array($fileInfo['extension'], $fileTypes)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Sat, 02 Sep 2023 18:50:24 +0000 by ClicShopping
                    
        $found[] = $current->getFileName();
      }
    }
    if ($found) { // Check the $found array is not empty

    }
    // Optional: Whitelist specific domains (e.g., GitHub)
    // Uncomment and modify as needed:
      $allowed_domains = ['github.com', 'api.github.com'];
      if (!in_array($parsed_url['host'] ?? '', $allowed_domains)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
        $this->messageStack->add('Download from unauthorized domain', 'error');
        CLICSHOPPING::redirect('Upgrade&Marketplace');
        return null;
       }

    $file_array = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory_selected));
    foreach ($file_array as $filename => $current) {
      $fileInfo = pathinfo($current->getFileName());
      if (array_key_exists('extension', $fileInfo) && in_array($fileInfo['extension'], $fileTypes)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Sat, 02 Sep 2023 18:50:24 +0000 by ClicShopping
                    
        $found[] = $current->getFileName();
      }
    }
    if ($found) { // Check the $found array is not empty

      $flags['session_id'] = false;
    }
    // Security: Validate method against whitelist
    $allowed_methods = ['post', 'get'];
    $safe_method = in_array(strtolower($method ?? 'post'), $allowed_methods) ? strtolower($method ?? 'post') : 'post';
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
    // Security: Sanitize form action URL
    $safe_action = static::sanitizeUrl($action);
    $form = '<form name="' . static::outputProtected($name) . '" action="' . $safe_action . '" method="' . $safe_method . '"';

        // Extract statement type
        $stmt_type = strtoupper(trim(explode(' ', $sql)[0]));
        // Whitelist allowed SQL types
        if (!in_array($stmt_type, $allowed_statements)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
          $CLICSHOPPING_MessageStack->add('Restore skipped: unsupported SQL statement type (' . $stmt_type . ')', 'warning');
          continue;
        }
        // Validate DROP TABLE statements to prevent SQL injection

    /* if empty error is produced : Fatal error: Uncaught exception 'RuntimeException'*/
    foreach (new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($template_directory)) as $filename => $current) {
      $fileInfo = pathinfo($current->getFileName());
      if (array_key_exists('extension', $fileInfo) && \in_array($fileInfo['extension'], $fileTypes)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Thu, 31 Aug 2023 00:24:19 +0000 by ClicShopping
                    
        $found[] = $current->getFileName();
      }
    }
    if ($found) { // Check the $found array is not empty

    $file_array = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($filename_selected));
    foreach ($file_array as $filename => $current) {
      $fileInfo = pathinfo($current->getFileName());
      if (array_key_exists('extension', $fileInfo) && in_array($fileInfo['extension'], $fileTypes)) {
in_array() should be called with the third parameter set to true to enable strict comparison and avoid type juggling bugs.
Time to fix: about 15 minutes
Read doc Permalink Copy Prompt

                                    Last edited Sat, 02 Sep 2023 18:50:24 +0000 by ClicShopping
                    
        $found[] = $current->getFileName();
      }
    }
    if ($found) { // Check the $found array is not empty

    $baseDir = CLICSHOPPING::getConfig('dir_root', 'Shop') . $CLICSHOPPING_Template->getDynamicTemplateDirectory() . '/files/';
    $filePath = realpath($baseDir . $filename_selected);
    // Sécuriser le chemin pour éviter directory traversal
    if ($filePath === false || strpos($filePath, realpath($baseDir)) !== 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Fri, 20 Jun 2025 04:22:27 +0000 by ClicShopping
                    
      $CLICSHOPPING_MessageStack->add($CLICSHOPPING_EditDesign->getDef('error_file_does_not_exist'), 'error');
      $CLICSHOPPING_EditDesign->redirect('EditModuleContent&action=directory&directory_html=' . $directory_selected);
      return false;
    }

    $basePathFallback = CLICSHOPPING::getConfig('dir_root', 'Shop') . $CLICSHOPPING_Template->getDynamicTemplateDirectory() . "/css/english/{$directory_selected}/";
    $filePath = realpath($basePathLang . $filename_selected);
    if ($filePath === false || strpos($filePath, realpath($basePathLang)) !== 0 || !is_file($filePath)) {
      $filePath = realpath($basePathFallback . $filename_selected);
      if ($filePath === false || strpos($filePath, realpath($basePathFallback)) !== 0 || !is_file($filePath)) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Fri, 20 Jun 2025 04:22:27 +0000 by ClicShopping
                    
        $CLICSHOPPING_MessageStack->add($CLICSHOPPING_EditDesign->getDef('error_file_does_not_exist'), 'error');
        $CLICSHOPPING_EditDesign->redirect('EditCss&action=directory&directory_css=' . $directory_selected);
        return false;
      }
    }

    $lang_dir = $CLICSHOPPING_Language->get('directory');
    $basePathLang = CLICSHOPPING::getConfig('dir_root', 'Shop') . $CLICSHOPPING_Template->getDynamicTemplateDirectory() . "/css/{$lang_dir}/{$directory_selected}/";
    $basePathFallback = CLICSHOPPING::getConfig('dir_root', 'Shop') . $CLICSHOPPING_Template->getDynamicTemplateDirectory() . "/css/english/{$directory_selected}/";
    $filePath = realpath($basePathLang . $filename_selected);
    if ($filePath === false || strpos($filePath, realpath($basePathLang)) !== 0 || !is_file($filePath)) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Fri, 20 Jun 2025 04:22:27 +0000 by ClicShopping
                    
      $filePath = realpath($basePathFallback . $filename_selected);
      if ($filePath === false || strpos($filePath, realpath($basePathFallback)) !== 0 || !is_file($filePath)) {
        $CLICSHOPPING_MessageStack->add($CLICSHOPPING_EditDesign->getDef('error_file_does_not_exist'), 'error');
        $CLICSHOPPING_EditDesign->redirect('EditCss&action=directory&directory_css=' . $directory_selected);
        return false;

        $CLICSHOPPING_templateCss->logSecurityError("CSS file not accessible", $cssFile);
        continue;
      }
      // Directory Traversal protection: ensure the file is within the allowed root directory
      if (strpos($real_path, $root_dir . DIRECTORY_SEPARATOR) !== 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Tue, 21 Apr 2026 11:46:19 +0000 by clicshopping
                    
        $CLICSHOPPING_templateCss->logSecurityError("CSS file outside allowed directory", $cssFile);
        continue;
      }
      // Check individual file size

          $this->logSecurityError("Invalid path detected", $path);
          continue;
        }
        // Ensure the resolved path is still within the root directory
        if (strpos($real_path, $root_dir) !== 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Tue, 21 Apr 2026 11:46:19 +0000 by clicshopping
                    
          $this->logSecurityError("Path traversal attempt detected", $real_path);
          continue;
        }
        if (is_file($real_path) && is_readable($real_path)) {

    $basePath = CLICSHOPPING::getConfig('dir_root', 'Shop') . $CLICSHOPPING_Template->getDynamicTemplateDirectory() . '/modules/' . $directory_selected . '/content/';
    $filePath = realpath($basePath . $filename_selected);
    // Sécurité chemin
    if ($filePath === false || strpos($filePath, realpath($basePath)) !== 0 || !is_file($filePath)) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Fri, 20 Jun 2025 04:22:27 +0000 by ClicShopping
                    
      $CLICSHOPPING_MessageStack->add($CLICSHOPPING_EditDesign->getDef('error_file_does_not_exist'), 'error');
      $CLICSHOPPING_EditDesign->redirect('EditModuleContent&action=directory&directory_html=' . $directory_selected);
      return false;
    }

      . $CLICSHOPPING_Template->getDynamicTemplateDirectory()
      . '/modules/' . $directory_selected . '/template_html/';
    $filePath = realpath($basePath . $filename_selected);
    if ($filePath === false || strpos($filePath, realpath($basePath)) !== 0 || !is_file($filePath)) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Fri, 20 Jun 2025 04:22:27 +0000 by ClicShopping
                    
      $CLICSHOPPING_MessageStack->add($CLICSHOPPING_EditDesign->getDef('error_file_does_not_exist'), 'error');
      $CLICSHOPPING_EditDesign->redirect('EditListing&action=directory&directory_html=' . $directory_selected);
      return false;
    }