How to fix the base64_encode and base64_decode to avoid injection? - wordpress

Question

I am using a theme option for WordPress with base64_encode and base64_decode. Since base64_ risk for the code injection, need to change that code.
Actually I have no idea how to do that.
The code contain base64_encode is like this:
new AjaxUpload(<?php echo ($value['id']); ?>, {
action: '<?php echo THEME_DIR; ?>/admin/upload-file.php',
name: '<?php echo ($upload_security)?>',
data: {
upload_path : '<?php echo base64_encode(UPFW_UPLOADS_DIR); ?>'
},
onSubmit: function(file, ext){
//Check if file is an image
if (! (ext && /^(JPG|PNG|GIF|jpg|png|jpeg|gif)$/.test(ext))){
// extension is not allowed
status.text('Only JPG, PNG or GIF files are allowed');
return false;
}
jQuery('#<?php echo ($value['id']); ?>loader').addClass('activeload');
},
onComplete: function(file, response){
//On completion clear the status
status.text('');
//Successful upload
if(response==="success"){
$file = file.toLowerCase().replace(/ /g,'_').replace(/(_)\1+/g, '_').replace(/[^\w\(\).-]/gi,'_').replace(/__/g,'_').replace(/#/g, '_');
//Preview uploaded file
jQuery('#<?php echo ($value['id']); ?>preview').removeClass('uploaderror');
jQuery('#<?php echo ($value['id']); ?>preview').html('<img class="preview" src="<?php echo UPFW_UPLOADS_URL; ?>/'+$file+'" alt="<?php echo ($value['id']); ?> Image" />').addClass('success');
//Add image source to hidden input
jQuery('input#<?php echo ($value['id']); ?>').attr('value', '<?php echo UPFW_UPLOADS_URL; ?>/'+$file);
//Append thumbnail to gallery
jQuery('.thumbs').append('<a class="preview" href="<?php echo UPFW_UPLOADS_URL; ?>/'+$file+'"><img src="<?php echo UPFW_UPLOADS_URL; ?>/'+$file+'" /></a>');
//Save Me Fool
activate_save_animation();
} else{
//Something went wrong
jQuery('#<?php echo ($value['id']); ?>preview').text(file+' did not upload. Please try again.').addClass('uploaderror');
}
jQuery('#<?php echo ($value['id']); ?>loader').removeClass('activeload');
}
});
and the code content base64_decode is like this:
<?php
//Upload Security
$upload_security = md5($_SERVER['SERVER_ADDR']);
$uploaddir = base64_decode( $_REQUEST['upload_path'] ) . "/";
if( $_FILES[$upload_security] ):
$file = $_FILES[$upload_security];
$file = $uploaddir . strtolower(str_replace('__', '_', str_replace('#', '_', str_replace(' ', '_', basename($file['name'])))));
if (move_uploaded_file( $_FILES[$upload_security]['tmp_name'], $file)):
if(chmod($file,0777)):
echo "success";
else:
echo "error".$_FILES[$upload_security]['tmp_name'];
endif;
else:
echo "error".$_FILES[$upload_security]['tmp_name'];
endif;
endif;
?>
Would really appreciate your help.
Thank you.

Answer 1

Moving this from comments to an answer because this is going to get detailed and hopefully it'll become one of those cool Stack Overflow answers people link to all over the place and I'll get all sorts of upvotes and job offers and free drinks at the local bar. Well, I'll settle for the upvotes. Or the drinks.
Hey, I'm home today. The baby's asleep. I've got some time to ramble.
base64
Things weren't always as standardized as they are now. For example, the computer I take my username from, the Commodore 64, encoded characters using Commodore's proprietary PETSCII instead of ASCII. Lots of IBM Mainframes used their own EBCDIC encoding, which was based on six-bit character encodings their older machines used. Six bits can represent the values 0-63, or 64 distinct characters.
There's also the fact that some characters are special. They represent things like tabs, invisible spaces, and data transfer control protocols. ASCII 7 is "BEL" and that would actually ring the bell on an ASR-33 teletype. But those characters are in different places and mean different things in the different character encodings.
To make sure email & Usenet worked between these ancient systems and the current standards, early Internet pioneers came up with base64 encoding, which encoded 8-bit data six bits at a time into a set of 64 "printable" (not control) characters. You still needed to decode it to eight bits at the other end, but any old 6-bit or 7-bit systems it passed through along the way couldn't mess it up.
So all base64_encode() and base64_decode() do is encode the data using a limited, standard set of characters. It's handy for storing binary data (like photos) in databases or encoding them in HTML <img> tags. It's a way around backslash escaping, which used to happen automatically sometimes in PHP. But it's not a kind of encryption or anything.
But base64 encoded text is friendly to old mainframes, not people. For example, "Hello World" becomes SGVsbG8gV29ybGQ=. And that's why people use it to hide evil code or things they don't want changed like copyright notices or links back to the theme builder's web site:
echo 'Get great answers at Stack Overflow';
becomes
eval(base64_decode('ZWNobyAnR2V0IGdyZWF0IGFuc3dlcnMgYXQgPGEgaHJlZj0iaHR0cDovL3N0YWNrb3ZlcmZsb3cu
Y29tIj5TdGFjayBPdmVyZmxvdzwvYT4nOw=='));
And that is what the WordPress.org theme review team doesn't want to see. That's the use of base64 they're concerned about. It's a way for people to obfuscate code, make it so people can't read it. It's risky, and it's against the spirit of open source.
Your example code
This code is dangerous:
data: {
upload_path : '<?php echo base64_encode(UPFW_UPLOADS_DIR); ?>'
}
UPFW_UPLOADS_DIR is a directory somewhere on your server, and it's just being base64 encoded. That means your JavaScript AJAX code sends a variable upload_path which has a value like L3Zhci93d3cvbXlzaXRlL3dwLWNvbnRlbnQvdXBsb2Fkcw== -- that's just /var/www/mysite/wp-content/uploads base64 encoded.
The PHP code on the server takes that value and decodes it:
$uploaddir = base64_decode( $_REQUEST['upload_path'] ) . "/";
then attaches the filename to that directory to build a file path:
$file = $uploaddir . strtolower(str_replace('__', '_', str_replace('#', '_', str_replace(' ', '_', basename($file['name'])))));
and moves the uploaded file to that new path:
if (move_uploaded_file( $_FILES[$upload_security]['tmp_name'], $file)):
This code is a back door to upload files anywhere your web server software(Apache, Nginx or similar) can write to on the disk
I could post to your /admin/upload-file.php script and give it an upload_dir like L3Zhci93d3cvbXlzaXRlL2luZGV4LnBocA==. Your code would take my file and replace WordPress's main index.php file (/var/www/mysite/index.php) with it.
Instead of sending the upload_dir to the browser and trusting you'll get back the same thing you sent, your code should just use UPFW_UPLOADS_DIR directly:
$file = UPFW_UPLOADS_DIR . '/' . strtolower(str_replace('__', '_', str_replace('#', '_', str_replace(' ', '_', basename($file['name'])))));
It looks like your upload code is a stand-alone PHP script instead of using WordPress's AJAX functionality. If that's the way you'd prefer it, you can bootstrap WordPress by including wp-load.php so its variables, constants (like UPFW_UPLOADS_DIR), and API are available in your code.