update.php fixes

Restrict update.php '#file' writes to the expected configuration roots
(/boot/config, /etc/wireguard) so a write cannot land outside config
storage via an absolute path or '..'. The target is resolved with
realpath() and range-checked with a shared in_safe_path() helper, which
is promoted into Wrappers.php; FileUpload.php now uses that shared copy.

Refs: OS-489

Author: elibosley

emhttp/plugins/dynamix/include/FileUpload.php

@@ -21,11 +21,7 @@
 $safeexts  = ['.png'];
 $result    = false;
 
-function in_safe_path(string $path, string $base): bool {
-  $path = rtrim($path, '/').'/';
-  $base = rtrim($base, '/').'/';
-  return strpos($path, $base) === 0;
-}
+// in_safe_path() is provided by the shared Wrappers.php (pulled in via Helpers.php)
 
 function remove_tree(string $dir): bool {
   if (!is_dir($dir)) return false;

emhttp/plugins/dynamix/include/Wrappers.php

@@ -39,6 +39,15 @@ function file_put_contents_atomic($filename,$data) {
   return strlen($data);
 }
 
+// Returns true when $path is contained within $base. Both arguments should be
+// canonicalized by the caller (e.g. via realpath) so that '..' segments and
+// symlinks cannot be used to escape $base.
+function in_safe_path(string $path, string $base): bool {
+  $path = rtrim($path, '/').'/';
+  $base = rtrim($base, '/').'/';
+  return strpos($path, $base) === 0;
+}
+
 // custom parse_ini_file/string functions to deal with '#' comment lines and remove html/php tags
 function my_parse_ini_string($text, $sections=false, $scanner=INI_SCANNER_NORMAL) {
   return parse_ini_string(strip_tags(html_entity_decode(preg_replace('/^#.*$/m','',$text))),$sections,$scanner);

emhttp/update.php

@@ -62,6 +62,26 @@ function write_log($string) {
   $raw_file = isset($_POST['#raw_file']) ? ($_POST['#raw_file'] === 'true') : false;
   // prepend with boot (flash) if path is relative
   if ($file && $file[0]!='/') $file = "/boot/config/plugins/$file";
+  // Confine '#file' to the allowed config roots so it can only write inside
+  // its expected locations. Resolve the nearest existing ancestor with
+  // realpath() (collapsing '..' and symlinks) since the target file/dir may
+  // not exist yet, then range-check it with the shared in_safe_path() helper.
+  $allowed_roots = ['/boot/config', '/etc/wireguard'];
+  // walk up from the target's directory to the nearest directory that exists,
+  // so confinement works regardless of how deep the not-yet-created target is
+  $resolved_dir = false;
+  for ($probe = dirname($file); ; $probe = dirname($probe)) {
+    if (($real = realpath($probe)) !== false) { $resolved_dir = $real; break; }
+    if (dirname($probe) === $probe) break; // reached '/' with nothing existing
+  }
+  $file_allowed  = false;
+  if (strpos($file, '..') === false && $resolved_dir !== false)
+    foreach ($allowed_roots as $root)
+      if (($base = realpath($root)) && in_safe_path($resolved_dir, $base)) { $file_allowed = true; break; }
+  if (!$file_allowed) {
+    syslog(LOG_WARNING, "update.php: refused '#file' write outside allowed paths: ".$_POST['#file']);
+    exit;
+  }
   $section = $_POST['#section'] ?? false;
   $cleanup = isset($_POST['#cleanup']);