diff --git a/vtlib/Vtiger/Deprecated.php b/vtlib/Vtiger/Deprecated.php index f574c1c5ae13a1ab39a9b3a86fe13910d8480b81..7a5288679a7f44f0d6ea6841a1b72423e20746a9 100644 --- a/vtlib/Vtiger/Deprecated.php +++ b/vtlib/Vtiger/Deprecated.php @@ -438,8 +438,15 @@ class Vtiger_Deprecated { $filePathParts = explode('/', $relativeFilePath); if (stripos($realfilepath, $rootdirpath) !== 0 || in_array($filePathParts[0], $unsafeDirectories)) { - die('Sorry! Attempt to access restricted file. - '.$filepath); - } + $a = debug_backtrace(); + $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n"; + $backtrace .= "FileAccessForInclusion - \n"; + foreach ($a as $b) { + $backtrace .= $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL; + } + Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace); + die('Sorry! Attempt to access restricted file.'); + } } /** Function to check the file deletion within the deletable (safe) directories*/ @@ -467,7 +474,14 @@ class Vtiger_Deprecated { $filePathParts = explode('/', $relativeFilePath); if (stripos($realfilepath, $rootdirpath) !== 0 || !in_array($filePathParts[0], $safeDirectories)) { - die('Sorry! Attempt to access restricted file. - '.$filepath); + $a = debug_backtrace(); + $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n"; + $backtrace .= "FileAccessForDeletion - \n"; + foreach ($a as $b) { + $backtrace .= $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL; + } + Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace); + die('Sorry! Attempt to access restricted file.'); } } @@ -475,7 +489,14 @@ class Vtiger_Deprecated { /** Function to check the file access is made within web root directory. */ static function checkFileAccess($filepath) { if (!self::isFileAccessible($filepath)) { - die('Sorry! Attempt to access restricted file. - '.$filepath); + $a = debug_backtrace(); + $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n"; + $backtrace .= "FileAccess - \n"; + foreach ($a as $b) { + $backtrace .= $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL; + } + Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace); + die('Sorry! Attempt to access restricted file.'); } } diff --git a/vtlib/Vtiger/Utils.php b/vtlib/Vtiger/Utils.php index 452ea7ab364261a4ab2724c29b999c8565ea7668..3c1f09d6cd48cde71a0118226b2250d9be67025e 100644 --- a/vtlib/Vtiger/Utils.php +++ b/vtlib/Vtiger/Utils.php @@ -16,6 +16,7 @@ include_once('include/utils/utils.php'); */ class Vtiger_Utils { protected static $logFileName = 'vtigermodule.log'; + protected static $logFolder = 'logs'; /** * Check if given value is a number or not @@ -71,10 +72,17 @@ class Vtiger_Utils { $filePathParts = explode('/', $relativeFilePath); if(stripos($realfilepath, $rootdirpath) !== 0 || in_array($filePathParts[0], $unsafeDirectories)) { - if($dieOnFail) { - die('Sorry! Attempt to access restricted file. - '.$filepath); - } - return false; + if($dieOnFail) { + $a = debug_backtrace(); + $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n"; + $backtrace .= "FileAccessForInclusion - \n"; + foreach ($a as $b) { + $backtrace .= $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL; + } + Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace); + die('Sorry! Attempt to access restricted file.'); + } + return false; } return true; } @@ -104,9 +112,16 @@ class Vtiger_Utils { $rootdirpath = str_replace('\\', '/', $rootdirpath); if(stripos($realfilepath, $rootdirpath) !== 0) { - if($dieOnFail) { - die('Sorry! Attempt to access restricted file. - '.$filepath); - } + if($dieOnFail) { + $a = debug_backtrace(); + $backtrace = 'Traced on '.date('Y-m-d H:i:s')."\n"; + $backtrace .= "FileAccess - \n"; + foreach ($a as $b) { + $backtrace .= $b['file'] . '::' . $b['function'] . '::' . $b['line'] . '<br>'.PHP_EOL; + } + Vtiger_Utils::writeLogFile('fileMissing.log', $backtrace); + die('Sorry! Attempt to access restricted file.'); + } return false; } return true; @@ -318,5 +333,17 @@ class Vtiger_Utils { fclose($fp); } } + + /** + * We should always create and log file inside logs folder as its protected from web-access. + * @param type $logFileName + * @param type $log + */ + public static function writeLogFile($logFileName, $log) { + if ($logFileName && $log) { + $logFilePath = self::$logFolder . '/' . $logFileName; + file_put_contents($logFilePath, print_r($log, true), FILE_APPEND); + } + } } ?>