[FIX] vulnerability in evil zip file unpacking and Windows path support

.gitignore

@@ -57,6 +57,9 @@ ftpsync.settings
 Thumbs.db
 Desktop.ini
 
+# SQLite database
+/core/database/*.sqlite
+
 # all dotfiles and dotfolders except do not ignore .gitignore
 **/.*
 !.gitignore

install/index.php

@@ -45,6 +45,12 @@
 // Define lock file path
 $lockfile = $base_path . 'install.session.php';
 
+if (file_exists("{$base_path}manager/includes/config.inc.php")) { ?>
+    Backup and delete the file `manager/includes/config.inc.php` then <a href="<?= htmlspecialchars($_SERVER['REQUEST_URI'],
+        ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') ?>" onclick="location.reload(true)">reload the page</a>
+    <?php exit();
+}
+
 // Ensure cache directory exists
 $cache_dir = EVO_CORE_PATH . 'storage/cache/';
 if (!is_dir($cache_dir)) {
@@ -138,7 +144,11 @@
     if (! file_exists($controller)) {
         die("Invalid install action attempted. [action={$action}]");
     }
-    require $controller;
+    try {
+        require $controller;
+    } catch (Exception $e) {
+        echo $e->getMessage();
+    }
 
     $ph['content'] = ob_get_contents();
     ob_end_clean();

install/src/controllers/connection.php

@@ -1,4 +1,5 @@
 <?php
+// step 2 part 2
 $installMode = isset($_POST['installmode']) ? (int)$_POST['installmode'] : 0;
 $dbTypes = ['mysql' => 'MySQL', 'pgsql' => 'PostgreSQL', 'sqlite' => 'SQLite'];
 
@@ -72,7 +73,7 @@
                 }
             }
             if (!$conn || !$result) {
-                $upgradeable = (isset($_POST['installmode']) && $_POST['installmode'] === 'new') ? 0 : 2;
+                $upgradeable = ($installMode === 0) ? 0 : 2;
             } else {
                 $upgradeable = 1;
             }
@@ -143,7 +144,7 @@
 $ph['database_name'] = escapeHtmlAttribute(isset($_POST['database_name']) ? $_POST['database_name'] : $database_name);
 $ph['tableprefix'] = escapeHtmlAttribute(isset($_POST['tableprefix']) ? $_POST['tableprefix'] : $table_prefix);
 $ph['database_collation'] = escapeHtmlAttribute(isset($_POST['database_collation']) ? $_POST['database_collation'] : $database_collation);
-$ph['show#AUH'] = ($installMode == 0) ? '' : 'hidden';
+$ph['show#AUH'] = ($installMode === 0) ? '' : 'hidden';
 $ph['cmsadmin'] = escapeHtmlAttribute(isset($_POST['cmsadmin']) ? $_POST['cmsadmin'] : 'admin');
 $ph['cmsadminemail'] = escapeHtmlAttribute(isset($_POST['cmsadminemail']) ? $_POST['cmsadminemail'] : '');
 $ph['cmspassword'] = escapeHtmlAttribute(isset($_POST['cmspassword']) ? $_POST['cmspassword'] : '');

install/src/controllers/connection/collation.php

@@ -1,10 +1,14 @@
 <?php
-$driver = validateDbType($_POST['database_type']);
-$host = validateDbHost($_POST['host'], $driver);
-$uid = validateDbUser($_POST['uid'], $driver);
-$pwd = validateDbPassword($_POST['pwd'], $driver);
-$database_name = isset($_POST['database_name']) && $_POST['database_name'] !== '' ? validateDbName($_POST['database_name']) : '';
-
+try {
+    $driver = validateDbType($_POST['database_type']);
+    $host = validateDbHost($_POST['host'], $driver);
+    $uid = validateDbUser($_POST['uid'], $driver);
+    $pwd = validateDbPassword($_POST['pwd'], $driver);
+    $database_name = isset($_POST['database_name']) && $_POST['database_name'] !== ''
+        ? validateDbName($_POST['database_name']) : '';
+} catch (Throwable $e) {
+    echo '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
+}
 try {
     $dsn = $driver . ':host=' . $host;
     $output = '<select id="database_collation" name="database_collation">';

install/src/controllers/connection/databasetest.php

@@ -101,6 +101,9 @@
         echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
         exit();
     }
+} catch (Throwable $e) {
+    echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
+    exit();
 }
 
 try {
@@ -143,8 +146,7 @@
 
     echo $output . '<span id="database_pass"> ' . $_lang['status_passed'] . '</span>';
     exit();
-} catch (PDOException $e) {
+} catch (Throwable $e) {
     echo $output . '<span id="database_fail">' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
+    exit();
 }
-
-echo $output;

install/src/controllers/connection/servertest.php

@@ -1,8 +1,12 @@
 <?php
-$method = validateDbType($_POST['database_type']);
-$host = validateDbHost($_POST['host'], $method);
-$uid = validateDbUser($_POST['uid'], $method);
-$pwd = validateDbPassword($_POST['pwd'], $method);
+try {
+    $method = validateDbType($_POST['database_type']);
+    $host = validateDbHost($_POST['host'], $method);
+    $uid = validateDbUser($_POST['uid'], $method);
+    $pwd = validateDbPassword($_POST['pwd'], $method);
+} catch (Throwable $e) {
+    exit('<span id="server_fail"> ' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>');
+}
 
 $output = $_lang['status_connecting'];
 try {
@@ -12,7 +16,7 @@
         $dbh = new PDO($method . ':host=' . $host . ($method === 'pgsql' ? ';dbname=postgres' : ''), $uid, $pwd);
     }
     $output .= '<span id="server_pass"> ' . $_lang['status_passed_server'] . '</span>';
-} catch (PDOException $e) {
+} catch (Throwable $e) {
     $output .= '<span id="server_fail"> ' . $_lang['status_failed'] . ' ' . $e->getMessage() . '</span>';
 }
 echo $output;

install/src/controllers/install.php

@@ -1,4 +1,5 @@
 <?php
+// step 5
 use EvolutionCMS\Facades\Console;
 
 ini_set('display_errors', 1);
@@ -74,10 +75,11 @@
 
 global $conn;
 try {
+    $pdoOptions = [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION];
     if ($database_type === 'sqlite') {
         $dbh = new PDO('sqlite:' . sqliteDbNameToPath($database_name));
     } else {
-        $dbh = new PDO($database_type . ':host=' . $database_server . ';dbname=' . $database_name, $database_user, $database_password);
+        $dbh = new PDO($database_type . ':host=' . $database_server . ';dbname=' . $database_name, $database_user, $database_password, $pdoOptions);
     }
 
     include dirname(__DIR__) . '/processor/result.php';
@@ -89,7 +91,7 @@
     }
     // select database
     if ($installLevel === 1) {
-        // write the config.inc.php file if new installation
+        // write the core/config/database/connections/default.php file if new installation
         $confph = [];
         $confph['database_server'] = addslashes($database_server);
         $confph['database_type'] = addslashes($database_type);

install/src/controllers/language.php

@@ -1,4 +1,5 @@
 <?php
+// step 1
 $content = file_get_contents(dirname(__DIR__) . '/template/actions/language.tpl');
 $content = parse($content, array_merge(ph(), ['langOptions' => getLangOptions($install_language)]));
 $content = parse($content, $_lang,'[%','%]');

install/src/controllers/mode.php

@@ -1,4 +1,5 @@
 <?php
+// step 2 part 1
 // Determine upgradeability
 $isConnectable = false;
 $installMode = isset($_POST['installmode']) ? (int)$_POST['installmode'] : 0;
@@ -11,8 +12,12 @@
     if (isset($db_config['database'])) {
         try {
             $pdoOptions = [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION];
-            $dbh = new PDO($db_config['driver'] . ':host=' . $db_config['host'] . ';dbname='
-                . $db_config['database'], $db_config['username'], $db_config['password'], $pdoOptions);
+            if ($db_config['driver'] === 'sqlite') {
+                $dbh = new PDO('sqlite:' . $db_config['database']);
+            } else {
+                $dbh = new PDO($db_config['driver'] . ':host=' . $db_config['host'] . ';dbname='
+                    . $db_config['database'], $db_config['username'], $db_config['password'], $pdoOptions);
+            }
             $isConnectable = true;
         } catch (PDOException $e) {
             $isConnectable = false;

install/src/controllers/options.php

@@ -1,4 +1,5 @@
 <?php
+// step 3
 const DB_CONNECTION_CONFIG_FILE = EVO_CORE_PATH . 'config/database/connections/default.php';
 $installMode = isset($_POST['installmode']) ? (int)$_POST['installmode'] : (is_readable(DB_CONNECTION_CONFIG_FILE) ? 1 : 0);
 

install/src/controllers/summary.php

@@ -1,4 +1,5 @@
 <?php
+// step 4
 if (!function_exists('f_owc')) {
     /**
      * @param $path
@@ -177,22 +178,6 @@ function f_owc($path, $data, $mode = null)
     echo '<span class="ok">' . $_lang['ok'] . '</span></p>';
 }
 
-// config.inc.php writable?
-echo '<p>' . $_lang['checking_if_config_exist_and_writable'];
-$tmp = '../' . MGR_DIR . '/includes/config.inc.php';
-if (!is_file($tmp)) {
-    f_owc($tmp, "<?php //EVO configuration file ?>", 0666);
-} else {
-    @chmod($tmp, 0666);
-}
-$isWriteable = is_writable($tmp);
-if (!$isWriteable) {
-    $errors++;
-    echo '<span class="notok">' . $_lang['failed'] . '</span></p><p><strong>' . $_lang['config_permissions_note'] . '</strong></p>';
-} else {
-    echo '<span class="ok">' . $_lang['ok'] . '</span></p>';
-}
-
 // connect to the database
 if ($installMode == 1) {
     $db_config = include_once EVO_CORE_PATH . 'config/database/connections/default.php';

install/src/functions.php

@@ -259,13 +259,14 @@ function validateLangCode($langCode)
  */
 function ph()
 {
-    global $_lang, $moduleName, $moduleVersion, $evo_textdir, $evo_release_date;
+    global $_lang, $base_path, $moduleVersion, $evo_textdir, $evo_release_date;
     $ph = [];
 
     if (isset($_SESSION['installmode'])) {
         $installmode = $_SESSION['installmode'];
     } else {
-        $installmode = get_installmode();
+        $installmode = isset($_POST['installmode']) ? (int)$_POST['installmode'] : 0;
+        // @deprecated get_installmode(); wants config.inc.php
     }
 
     $ph['pagetitle'] = $_lang['modx_install'];
@@ -282,6 +283,7 @@ function ph()
 }
 
 /**
+ * @deprecated config.inc.php was split to Laravel configs
  * @return int
  */
 function get_installmode()