Changeset 3763334

Timestamp:

10/24/2026 01:47:30 PM (17 hours ago)

Author:

vrcs66

Message:

Version 2.3 security patch

Location:

chat-ai-with-dispatcher/trunk

Files:

• chat-ai-with-dispatcher.php (modified) (1 diff)
• includes/frontend/frontend-chataiwd-module.php (modified) (8 diffs)
• readme.txt (modified) (3 diffs)

chat-ai-with-dispatcher/trunk/chat-ai-with-dispatcher.php

@@ -16 +16 @@
  * Plugin Name: Chat AI with Dispatcher
  * Description: A free live chat solution with AI and human supervision.
- * Version: 2.2
+ * Version: 2.3
  * Author: Csaba Váradi
  * Author URI: https://www.vrcs.hu/

chat-ai-with-dispatcher/trunk/includes/frontend/frontend-chataiwd-module.php

@@ -737 +737 @@
         'name'     => isset( $_FILES['attachment']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['attachment']['name'] ) ) : '',
         'type'     => isset( $_FILES['attachment']['type'] ) ? sanitize_mime_type( wp_unslash( $_FILES['attachment']['type'] ) ) : '',
-        'tmp_name' => $tmp_name, // Itt az eredeti C:/wamp64/... útvonal marad meg
+        'tmp_name' => $tmp_name,
         'size'     => isset( $_FILES['attachment']['size'] ) ? (int) $_FILES['attachment']['size'] : 0,
     );
 
-
-
-
-    // PDF gyors kezelése
+    // PDF gyors kezelése (változatlanul hagyva)
     if ($file['type'] === 'application/pdf') {
-        $pdf_icon = plugins_url('assets/images/pdf_icon.png', dirname(__FILE__)); // Ellenőrizd az útvonalat!
+        $pdf_icon = plugins_url('assets/images/pdf_icon.png', dirname(__FILE__));
         $json['success']          = true;
         $json['thumbnail_url']    = $pdf_icon;
@@ -757 +754 @@
     $base_dir   = $upload_dir['basedir'];
 
-    // Mappa kezelése - JAVÍTVA
     $temp_sub_dir = 'chataiwd_temp/';
     $temp_dir     = trailingslashit($base_dir) . $temp_sub_dir;
@@ -765 +761 @@
     }
 
-    // Fájlnév generálása (érdemes egy egyedi ID-t elé tenni, mint OC-ben, hogy ne írják felül egymást)
-    $filename = time() . '-' . $file['name'];
+    // 1. JAVÍTÁS (AUTOMATTIC KÉRÉSE): A basename() hozzáadása a fájlnévhez, hogy ne lehessen ../ trükk:
+    $filename = time() . '-' . basename( $file['name'] );
     $copied_file_path = $temp_dir . $filename;
 
@@ -774 +770 @@
     }
 
-    // MIME ellenőrzés finfo-val
+    // MIME ellenőrzés finfo-val (változatlanul)
     $finfo = finfo_open(FILEINFO_MIME_TYPE);
     $mime_type = finfo_file($finfo, $copied_file_path);
@@ -782 +778 @@
 
     if ( $is_image ) {
-        // Itt hívod meg a resizing funkciót
         $thumbnail_url = chataiwd_generate_resized_image( $copied_file_path, 160 );
         $preview_url   = chataiwd_generate_resized_image( $copied_file_path, 500 );
@@ -791 +786 @@
         }
 
-        $json['success']          = true;
-        /*$json['thumbnail_url']    = $thumbnail_url;
-        $json['preview_url']      = $preview_url;
-        $json['copied_file_path'] = $temp_sub_dir . $filename; // Relatív útvonal
-        */
-
-        $json['thumbnail'] = $thumbnail_url;
+        $json['success']        = true;
+        $json['thumbnail']      = $thumbnail_url;
         $json['temp_file_path'] = $preview_url;
 
@@ -803 +793 @@
 
     } else {
+        // 2. JAVÍTÁS: Ha kiderül, hogy nem kép volt, azonnal letöröljük a másolatot a szerverről!
+        if ( file_exists( $copied_file_path ) ) {
+            wp_delete_file( $copied_file_path );
+        }
+
         $json['error'] = 'Invalid image format.';
         wp_send_json( $json );
@@ -816 +811 @@
 
     $json = array( 'success' => false );
-    // FRISSÍTVE: A JS-ből 'copied_file_path'-ként kell érkeznie
-    $copied_file_path = isset( $_POST['copied_file_path'] ) ? sanitize_text_field( wp_unslash( $_POST['copied_file_path'] ) ) : '';
-
-    if ( empty( $copied_file_path ) ) {
-        // ...
+
+    $raw_path = isset( $_POST['temp_file_path'] ) ? $_POST['temp_file_path'] : ( $_POST['copied_file_path'] ?? '' );
+    $raw_path = sanitize_text_field( wp_unslash( $raw_path ) );
+
+    if ( empty( $raw_path ) ) {
+        $json['error'] = 'Missing file path.';
+        wp_send_json( $json );
+        return;
     }
 
     $upload_dir = wp_upload_dir();
-    // FRISSÍTVE: 'copied_file_path' használata
-    $file_to_delete = trailingslashit( $upload_dir['basedir'] ) . $copied_file_path;
-    $filename = basename( $file_to_delete );
-
-    // Töröljük az eredeti másolatot
-    if ( file_exists( $file_to_delete ) ) {
-        wp_delete_file( $file_to_delete );
-
-        // Próbáljuk törölni a hozzá tartozó ikont is
-        $resized_dir = dirname( $file_to_delete ) . '/resized/';
-
-        $icon_file_name = pathinfo($filename,PATHINFO_FILENAME) . '_160.' . pathinfo($filename,PATHINFO_EXTENSION);
-        $resized_icon_path = $resized_dir . $icon_file_name;
-
-        if ( file_exists( $resized_icon_path ) ) {
-            wp_delete_file( $resized_icon_path ); // @ - hiba elnyomása, ha valamiért nem törölhető
-        }
-
-        // Törölhetjük a preview_500-at is, ha létezik (bár a JS hívás után ez elvileg a sendMessage-ben történik)
-        $preview_file_name = pathinfo($filename,PATHINFO_FILENAME) . '500.' . pathinfo($filename,PATHINFO_EXTENSION);
-        wp_delete_file( $resized_dir . $preview_file_name );
+    $temp_dir   = trailingslashit( $upload_dir['basedir'] ) . 'chataiwd_temp';
+    $real_temp_dir = realpath( $temp_dir );
+
+    $filename = basename( sanitize_file_name( $raw_path ) );
+    $file_to_delete = trailingslashit( $temp_dir ) . $filename;
+    $real_file_path = realpath( $file_to_delete );
+
+    if ( $real_temp_dir && $real_file_path && 0 === strpos( $real_file_path, $real_temp_dir ) && file_exists( $real_file_path ) ) {
+
+        wp_delete_file( $real_file_path );
+
+        $resized_dir = trailingslashit( $temp_dir ) . 'resized/';
+        $real_resized_dir = realpath( $resized_dir );
+
+        if ( $real_resized_dir && is_dir( $real_resized_dir ) ) {
+            $ext  = pathinfo( $filename, PATHINFO_EXTENSION );
+            $name = pathinfo( $filename, PATHINFO_FILENAME );
+
+            $icon_file_name    = $name . '_160.' . $ext;
+            $resized_icon_path = trailingslashit( $real_resized_dir ) . $icon_file_name;
+            if ( file_exists( $resized_icon_path ) ) {
+                wp_delete_file( $resized_icon_path );
+            }
+
+            $preview_file_name = $name . '500.' . $ext;
+            $preview_path      = trailingslashit( $real_resized_dir ) . $preview_file_name;
+            if ( file_exists( $preview_path ) ) {
+                wp_delete_file( $preview_path );
+            }
+        }
 
         $json['success'] = true;
-        _wp_send_json( $json );
-    } else {
-        $json['error'] = 'File not found.';
-        wp_send_json( $json );
-    }
+        wp_send_json( $json );
+        return;
+    }
+
+    $json['error'] = 'File not found or access denied.';
+    wp_send_json( $json );
 }
 

chat-ai-with-dispatcher/trunk/readme.txt

@@ -5 +5 @@
 **Tested up to:** 6.9
 **Requires PHP:** 7.4
-**Stable tag:** 2.2
+**Stable tag:** 2.3
 **License:** GPLv2 or later
 **License URI:** https://www.gnu.org/licenses/gpl-2.0.html
@@ -23 +23 @@
 - Mobile-friendly and easy to install.
 
-[youtube https://youtu.be/i5akM_zmMOE]
+[youtube https://youtu.be/3zQa2NOSucs]
 
 ---
@@ -98 +98 @@
 
 ## Changelog
+### 2.3.0
+* Security fix: Path traversal prevention and directory containment check in temporary file handlers. (Credit: Muni Nitish Kumar Yaddala)
+
 ### 2.2.0
 * WhatsApp Integration: Direct WhatsApp contact button added to the chat interface with admin-configurable phone numbers.