Fixes the file path disclosure in error messages, instead logged

vtlib/Vtiger/Deprecated.php

@@ -438,8 +438,15 @@ class Vtiger_Deprecated {
 		$filePathParts = explode('/', $relativeFilePath);
 
 		if (stripos($realfilepath, $rootdirpath) !== 0 || in_array($filePathParts[0], $unsafeDirectories)) {
-			die('Sorry! Attempt to access restricted file. - '.$filepath);
-		}
+			$a = debug_backtrace();
+                        $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n";
+                        $backtrace .= "FileAccessForInclusion - \n";
+                        foreach ($a as $b) {
+                            $backtrace .=  $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL;
+                        }
+                        Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace);
+                        die('Sorry! Attempt to access restricted file.');
+                }
 	}
 
 	/** Function to check the file deletion within the deletable (safe) directories*/
@@ -467,7 +474,14 @@ class Vtiger_Deprecated {
 		$filePathParts = explode('/', $relativeFilePath);
 
 		if (stripos($realfilepath, $rootdirpath) !== 0 || !in_array($filePathParts[0], $safeDirectories)) {
-			die('Sorry! Attempt to access restricted file. - '.$filepath);
+                    $a = debug_backtrace();
+                    $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n";
+                    $backtrace .= "FileAccessForDeletion - \n";
+                    foreach ($a as $b) {
+                        $backtrace .=  $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL;
+                    }
+                    Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace);
+		    die('Sorry! Attempt to access restricted file.');
 		}
 
 	}
@@ -475,7 +489,14 @@ class Vtiger_Deprecated {
 	/** Function to check the file access is made within web root directory. */
 	static function checkFileAccess($filepath) {
 		if (!self::isFileAccessible($filepath)) {
-			die('Sorry! Attempt to access restricted file. - '.$filepath);
+                    $a = debug_backtrace();
+                    $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n";
+                    $backtrace .= "FileAccess - \n";
+                    foreach ($a as $b) {
+                        $backtrace .=  $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL;
+                    }
+                    Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace);
+                    die('Sorry! Attempt to access restricted file.');
 		}
 	}
 

vtlib/Vtiger/Utils.php

@@ -16,6 +16,7 @@ include_once('include/utils/utils.php');
  */
 class Vtiger_Utils {
     protected static $logFileName = 'vtigermodule.log';
+    protected static $logFolder = 'logs';
     
 	/**
 	 * Check if given value is a number or not
@@ -71,10 +72,17 @@ class Vtiger_Utils {
 		$filePathParts = explode('/', $relativeFilePath);
 
 		if(stripos($realfilepath, $rootdirpath) !== 0 || in_array($filePathParts[0], $unsafeDirectories)) {
-			if($dieOnFail) {
-				die('Sorry! Attempt to access restricted file. - '.$filepath);
-			}
-			return false;
+                    if($dieOnFail) {
+                        $a = debug_backtrace();
+                        $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n";
+                        $backtrace .= "FileAccessForInclusion - \n";
+                        foreach ($a as $b) {
+                             $backtrace .=  $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL;
+                        }
+                        Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace);
+                        die('Sorry! Attempt to access restricted file.');
+                    }
+                    return false;
 		}
 		return true;
 	}
@@ -104,9 +112,16 @@ class Vtiger_Utils {
 		$rootdirpath  = str_replace('\\', '/', $rootdirpath);
 
 		if(stripos($realfilepath, $rootdirpath) !== 0) {
-			if($dieOnFail) {
-				die('Sorry! Attempt to access restricted file. - '.$filepath);
-			}
+                    if($dieOnFail) {
+                        $a = debug_backtrace();
+                        $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n";
+                        $backtrace .= "FileAccess - \n";
+                        foreach ($a as $b) {
+                              $backtrace .=  $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL;
+                        }
+                        Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace);
+                        die('Sorry! Attempt to access restricted file.');
+                    }
 			return false;
 		}
 		return true;
@@ -318,5 +333,17 @@ class Vtiger_Utils {
             fclose($fp);
         }
     }
+    
+    /**
+     * We should always create and log file inside logs folder as its protected from web-access.
+     * @param type $logFileName
+     * @param type $log
+     */
+    public static function writeLogFile($logFileName, $log) {
+        if ($logFileName && $log) {
+            $logFilePath = self::$logFolder . '/' . $logFileName;
+            file_put_contents($logFilePath, print_r($log, true), FILE_APPEND);
+        }
+    }
 }
 ?>