Hello,
I experimented a bit with opentbs (and other software). I need a system that allows users to upload a template and then creates a odt/pdf based on it.
I have gotten it working, I can generate the files, create jpg previews and do other things.
I am now trying to secure the whole thing. I use libreoffice for converting odt->pdf, this can be put in a sandboy easily.
I have more problems with OpenTBS, since it is a lot easier to use if I don't need to sandbox it.
I managed to disable the $GLOBALS access.
I prevent any use of user functions (but not all. ondata seems not to be affected)
class NoFunctions implements \ArrayAccess {
public function offsetExists($o) {
return true;
}
public function offsetGet($o) {
return function() { return ''; };
}
public function offsetSet($o, $val) {
// ignore
}
public function offsetUnset($o) {
// ignore
}
}
// internal but works.
$TBS->_UserFctLst = new NoFunctions;
// not required any more
$TBS->SetOption('fct_prefix', 'THERE_IS_NO_SUCH_FUNCTION');
|
This is how far I came until now.
For access permissions on the images, I could overwrite the Method TbsPicExternalPath in clsOpenTBS. I have not found the best way to do it, I don't really want to change the code unless I need to.
I want to prevent any function calls, object instantiations and other possibilities of users running code.
Has anyone done this? Is OpenTBS even designed to work this way or do I need to sandbox it using a separate PHP process?