Restoring a plugin from an archive, or installing one downloaded from
GitHub into the database, extracts the tgz to a temp file and writes each
entry under plugins/<name>/. validate_relative_path_within() anchored a
not-yet-created entry on its immediate parent directory, so every entry in
a subdirectory the restore had not created yet (includes/, css/, tests/,
docs/, ...) resolved against a missing path, failed the containment check
and was skipped. The plugin was left with only its top-level files and
setup.php then fatally required the missing includes/database.php.
Judge a not-yet-created entry by its deepest existing ancestor instead,
mirroring data_source_path_within_rra(). Every path segment is already a
validated plain name and no walked segment may be a symlink, so the full
candidate still stays within the base; traversal, absolute, drive-letter,
null-byte and symlink entries remain rejected.
* fix: reject dangling symlinks in validate_relative_path_within
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add changelog entry for dangling symlink fix
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Contain plugin archive writes and validate the repository URL
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Use the full Cacti copyright header and reject non-base repository URLs
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Move the path containment helpers into lib/functions.php
They live in lib/functions.php on 1.2.x; keeping a separate module on develop
split the same helpers across two files. plugin_validate_repository_url() goes
to lib/plugins.php with its caller.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: refresh the sink baseline for the containment guard
The archive guard shifts eleven sink line numbers in lib/plugins.php.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: drop the baseline refresh this branch did not need
The sink and hotspot gates compare on a line-agnostic signature, so pure line
drift never tripped them and refreshing only invites merge conflicts.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
TheWitness