CVE-2015-0269

@@ -1,6 +1,14 @@
 Contao Open Source CMS changelog
 ================================
 
+Version 3.2.19 (2015-02-XX)
+---------------------------
+
+### Fixed
+Fixed a directory traversal vulnerability discovered by Arnaud Buchoux. See
+CVE-2015-0269 for more information.
+
+
 Version 3.2.18 (2015-01-30)
 ---------------------------
 

@@ -515,6 +515,8 @@ public static function findSearchablePages($pid=0, $domain='', $blnIsSitemap=fal
 	 * Add a breadcrumb menu to the page tree
 	 *
 	 * @param string
+	 *
+	 * @throws \RuntimeException
 	 */
 	public static function addPagesBreadcrumb($strKey='tl_page_node')
 	{
@@ -523,7 +525,13 @@ public static function addPagesBreadcrumb($strKey='tl_page_node')
 		// Set a new node
 		if (isset($_GET['node']))
 		{
-			$objSession->set($strKey, \Input::get('node'));
+			// Check the path (thanks to Arnaud Buchoux)
+			if (\Validator::isInsecurePath(\Input::get('node', true)))
+			{
+				throw new \RuntimeException('Insecure path ' . \Input::get('node', true));
+			}
+
+			$objSession->set($strKey, \Input::get('node', true));
 			\Controller::redirect(preg_replace('/&node=[^&]*/', '', \Environment::get('request')));
 		}
 
@@ -534,6 +542,12 @@ public static function addPagesBreadcrumb($strKey='tl_page_node')
 			return;
 		}
 
+		// Check the path (thanks to Arnaud Buchoux)
+		if (\Validator::isInsecurePath($intNode))
+		{
+			throw new \RuntimeException('Insecure path ' . $intNode);
+		}
+
 		$arrIds   = array();
 		$arrLinks = array();
 		$objUser  = \BackendUser::getInstance();
@@ -653,6 +667,8 @@ public static function addPageIcon($row, $label, DataContainer $dc=null, $imageA
 	 * Add a breadcrumb menu to the file tree
 	 *
 	 * @param string
+	 *
+	 * @throws \RuntimeException
 	 */
 	public static function addFilesBreadcrumb($strKey='tl_files_node')
 	{
@@ -661,6 +677,12 @@ public static function addFilesBreadcrumb($strKey='tl_files_node')
 		// Set a new node
 		if (isset($_GET['node']))
 		{
+			// Check the path (thanks to Arnaud Buchoux)
+			if (\Validator::isInsecurePath(\Input::get('node', true)))
+			{
+				throw new \RuntimeException('Insecure path ' . \Input::get('node', true));
+			}
+
 			$objSession->set($strKey, \Input::get('node', true));
 			\Controller::redirect(preg_replace('/(&|\?)node=[^&]*/', '', \Environment::get('request')));
 		}
@@ -672,6 +694,12 @@ public static function addFilesBreadcrumb($strKey='tl_files_node')
 			return;
 		}
 
+		// Check the path (thanks to Arnaud Buchoux)
+		if (\Validator::isInsecurePath($strNode))
+		{
+			throw new \RuntimeException('Insecure path ' . $strNode);
+		}
+
 		// Currently selected folder does not exist
 		if (!is_dir(TL_ROOT . '/' . $strNode))
 		{

@@ -136,12 +136,20 @@ class tl_templates extends Backend
 
 	/**
 	 * Add the breadcrumb menu
+	 *
+	 * @throws RuntimeException
 	 */
 	public function addBreadcrumb()
 	{
 		// Set a new node
 		if (isset($_GET['node']))
 		{
+			// Check the path (thanks to Arnaud Buchoux)
+			if (Validator::isInsecurePath(Input::get('node', true)))
+			{
+				throw new RuntimeException('Insecure path ' . Input::get('node', true));
+			}
+
 			$this->Session->set('tl_templates_node', Input::get('node', true));
 			$this->redirect(preg_replace('/(&|\?)node=[^&]*/', '', Environment::get('request')));
 		}
@@ -153,6 +161,12 @@ public function addBreadcrumb()
 			return;
 		}
 
+		// Check the path (thanks to Arnaud Buchoux)
+		if (Validator::isInsecurePath($strNode))
+		{
+			throw new RuntimeException('Insecure path ' . $strNode);
+		}
+
 		// Currently selected folder does not exist
 		if (!is_dir(TL_ROOT . '/' . $strNode))
 		{

@@ -337,6 +337,12 @@ public static function isInsecurePath($strPath)
 		$strPath = str_replace('\\', '/', $strPath);
 		$strPath = preg_replace('#//+#', '/', $strPath);
 
+		// Equals ..
+		if ($strPath == '..')
+		{
+			return true;
+		}
+
 		// Begins with ./
 		if (substr($strPath, 0, 2) == './')
 		{