1 | <?php |
||
11 | class EnvironmentController extends Controller |
||
12 | { |
||
13 | /** |
||
14 | * @var EnvironmentManager |
||
15 | */ |
||
16 | protected $EnvironmentManager; |
||
17 | protected $envPath; |
||
18 | |||
19 | /** |
||
20 | * @param EnvironmentManager $environmentManager |
||
21 | */ |
||
22 | public function __construct(EnvironmentManager $environmentManager) |
||
23 | { |
||
24 | $this->EnvironmentManager = $environmentManager; |
||
25 | $this->envPath = base_path('.env'); |
||
26 | } |
||
27 | |||
28 | /** |
||
29 | * Display the Environment page. |
||
30 | * |
||
31 | * @return \Illuminate\View\View |
||
32 | */ |
||
33 | public function index() |
||
34 | { |
||
35 | $envConfig = $this->EnvironmentManager->getEnvContent(); |
||
36 | $fields = $this->breakApartEnv($envConfig); |
||
37 | |||
38 | return view('vendor.installer.environment', compact('fields')); |
||
39 | } |
||
40 | |||
41 | /** |
||
42 | * Processes the newly saved environment configuration and redirects back. |
||
43 | * |
||
44 | * @param Request $input |
||
45 | * |
||
46 | * @return \Illuminate\Http\RedirectResponse |
||
47 | */ |
||
48 | public function store(Request $input) |
||
49 | { |
||
50 | $env = $this->flattenRequest($input); |
||
51 | $message = $this->saveFile($env); |
||
52 | |||
53 | Artisan::call('key:generate'); |
||
54 | |||
55 | return redirect()->route('LaravelInstaller::requirements') |
||
56 | ->with(['message' => $message]); |
||
57 | } |
||
58 | |||
59 | /** |
||
60 | * Key should be before the first = symbol and value should be after. |
||
61 | * Each new line (\r\n) should be a new array entry. |
||
62 | * |
||
63 | * @param $string |
||
64 | * |
||
65 | * @return array |
||
66 | */ |
||
67 | private function breakApartEnv($string) |
||
68 | { |
||
69 | preg_match_all('/([^=]*?)=([^\r\n]*?)[\r\n]+/', $string, $matches); |
||
70 | |||
71 | return array_combine($matches[1], $matches[2]); |
||
72 | } |
||
73 | |||
74 | private function flattenRequest(Request $input) |
||
87 | |||
88 | /** |
||
89 | * Save the edited content to the file. |
||
90 | * |
||
91 | * @param $string |
||
92 | * |
||
93 | * @return string |
||
94 | */ |
||
95 | public function saveFile($string) |
||
107 | } |
||
108 |
$string
can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.8 paths for user data to reach this point
$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assigned in ServerBag.php on line 62$this->parameters['HTTP_AUTHORIZATION']
seems to return tainted data, and$authorizationHeader
is assignedin vendor/ServerBag.php on line 62
in vendor/ServerBag.php on line 77
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
$_POST,
and$_POST
is passed to Request::createRequestFromFactory() in Request.php on line 281$_POST,
and$_POST
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$request
is passed to Request::__construct()in vendor/Request.php on line 1939
$request
is passed to Request::initialize()in vendor/Request.php on line 222
$request
is passed to ParameterBag::__construct()in vendor/Request.php on line 240
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
$_SERVER,
and$server
is assigned in Request.php on line 271$_SERVER,
and$server
is assignedin vendor/Request.php on line 271
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assigned in Request.php on line 274HTTP_CONTENT_LENGTH
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 274
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assigned in Request.php on line 277HTTP_CONTENT_TYPE
from$_SERVER,
and$server
is assignedin vendor/Request.php on line 277
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 281
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
$server['HTTP_HOST']
seems to return tainted data, and$server
is assigned in Request.php on line 347$server['HTTP_HOST']
seems to return tainted data, and$server
is assignedin vendor/Request.php on line 347
$server
is assignedin vendor/Request.php on line 395
$server
is assignedin vendor/Request.php on line 396
$server
is passed to Request::createRequestFromFactory()in vendor/Request.php on line 398
$server
is passed to Request::__construct()in vendor/Request.php on line 1939
$server
is passed to Request::initialize()in vendor/Request.php on line 222
$server
is passed to ParameterBag::__construct()in vendor/Request.php on line 245
in vendor/ParameterBag.php on line 35
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 43$this->parameters['PHP_AUTH_USER']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 43
$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 246
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 142
in vendor/HeaderBag.php on line 145
in vendor/HeaderBag.php on line 125
$requestUri
is assignedin vendor/Request.php on line 1709
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1740
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assigned in ServerBag.php on line 44$this->parameters['PHP_AUTH_PW']
seems to return tainted data, and$headers
is assignedin vendor/ServerBag.php on line 44
$this->server->getHeaders()
is passed to HeaderBag::__construct()in vendor/Request.php on line 246
$values
is assignedin vendor/HeaderBag.php on line 31
$values
is passed to HeaderBag::set()in vendor/HeaderBag.php on line 32
(array) $values
is passed through array_values(), and$values
is assignedin vendor/HeaderBag.php on line 142
in vendor/HeaderBag.php on line 145
in vendor/HeaderBag.php on line 125
$requestUri
is assignedin vendor/Request.php on line 1709
$requestUri
is passed to ParameterBag::set()in vendor/Request.php on line 1740
in vendor/ParameterBag.php on line 99
in vendor/ParameterBag.php on line 45
$files
is assignedin vendor/src/Illuminate/Http/Request.php on line 431
in vendor/src/Illuminate/Http/Request.php on line 454
in vendor/src/Illuminate/Http/Request.php on line 435
in vendor/src/Illuminate/Http/Request.php on line 434
$this->allFiles()
is passed through array_replace_recursive()in vendor/src/Illuminate/Http/Request.php on line 323
in vendor/src/Illuminate/Http/Request.php on line 1015
$input->toArray()
is passed through array_merge(), and$results
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 77
$key
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 81
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 82
$env
is assignedin app/Http/Controllers/Installation/EnvironmentController.php on line 50
$env
is passed to EnvironmentController::saveFile()in app/Http/Controllers/Installation/EnvironmentController.php on line 51
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: