From 378c3820bf1a3c184640cd8bbe95a3b1f30ff747 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Fri, 22 Jul 2016 11:49:35 +0200
Subject: [PATCH] Sanitize filename on SHP import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/plugins/import/ImportShp.class.php | 26 +++++++++++---------
 libraries/zip_extension.lib.php              | 13 +++++-----
 test/libraries/PMA_zip_extension_test.php    | 12 ++++++---
 3 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/libraries/plugins/import/ImportShp.class.php b/libraries/plugins/import/ImportShp.class.php
index c5b3cc2124..70e4bdef04 100644
--- a/libraries/plugins/import/ImportShp.class.php
+++ b/libraries/plugins/import/ImportShp.class.php
@@ -119,19 +119,23 @@ class ImportShp extends ImportPlugin
                     // Extract the .dbf file and point to it.
                     $extracted =  PMA_zipExtract(
                         $import_file,
-                        realpath($GLOBALS['cfg']['TempDir']),
-                        array($dbf_file_name)
+                        $dbf_file_name
                     );
-                    if ($extracted) {
+                    if ($extracted !== false) {
                         $dbf_file_path = realpath($GLOBALS['cfg']['TempDir'])
-                            . (PMA_IS_WINDOWS ? '\\' : '/') . $dbf_file_name;
-                        $temp_dbf_file = true;
-                        // Replace the .dbf with .*, as required
-                        // by the bsShapeFiles library.
-                        $file_name = substr(
-                            $dbf_file_path, 0, strlen($dbf_file_path) - 4
-                        ) . '.*';
-                        $shp->FileName = $file_name;
+                            . (PMA_IS_WINDOWS ? '\\' : '/') . PMA_sanitizeFilename($dbf_file_name, true);
+                        $handle = fopen($dbf_file_path, 'wb');
+                        if ($handle !== false) {
+                            fwrite($handle, $extracted);
+                            fclose($handle);
+                            $temp_dbf_file = true;
+                            // Replace the .dbf with .*, as required
+                            // by the bsShapeFiles library.
+                            $file_name = substr(
+                                $dbf_file_path, 0, strlen($dbf_file_path) - 4
+                            ) . '.*';
+                            $shp->FileName = $file_name;
+                        }
                     }
                 }
             } elseif (! empty($local_import_file)
diff --git a/libraries/zip_extension.lib.php b/libraries/zip_extension.lib.php
index db493e7f43..7c56498be3 100644
--- a/libraries/zip_extension.lib.php
+++ b/libraries/zip_extension.lib.php
@@ -137,19 +137,18 @@ function PMA_getNoOfFilesInZip($file)
 /**
  * Extracts a set of files from the given zip archive to a given destinations.
  *
- * @param string $zip_path    path to the zip archive
- * @param string $destination destination to extract files
- * @param array  $entries     files in archive that should be extracted
+ * @param string $zip_path path to the zip archive
+ * @param string $entry    file in the archive that should be extracted
  *
- * @return bool true on sucess, false otherwise
+ * @return string|bool data on sucess, false otherwise
  */
-function PMA_zipExtract($zip_path, $destination, $entries)
+function PMA_zipExtract($zip_path, $entry)
 {
     $zip = new ZipArchive;
     if ($zip->open($zip_path) === true) {
-        $zip->extractTo($destination, $entries);
+        $result = $zip->getFromName($entry);
         $zip->close();
-        return true;
+        return $result;
     }
     return false;
 }
diff --git a/test/libraries/PMA_zip_extension_test.php b/test/libraries/PMA_zip_extension_test.php
index 54049a8ee7..9aafe2c92a 100644
--- a/test/libraries/PMA_zip_extension_test.php
+++ b/test/libraries/PMA_zip_extension_test.php
@@ -114,10 +114,16 @@ class PMA_zip_extension_test extends PHPUnit_Framework_TestCase
     public function testZipExtract()
     {
         $this->assertEquals(
+            false,
             PMA_zipExtract(
-                './test/test_data/test.zip', './test/test_data/', 'wrongName'
-            ),
-            true
+                './test/test_data/test.zip', 'wrongName'
+            )
+        );
+        $this->assertEquals(
+            "TEST FILE\n",
+            PMA_zipExtract(
+                './test/test_data/test.zip', 'test.file'
+            )
         );
     }