Skip to content

Commit 7d37cf6

Browse files
g-bougardg-bougard
committed
fix: Fix regression from 1.7.2 which always set LOCAL if not used
CVE-2024-28241 fix is also optimazed
1 parent 6d050ba commit 7d37cf6

File tree

4 files changed

+44
-31
lines changed

4 files changed

+44
-31
lines changed

‎Changes

+8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
Revision history for GLPI agent
22

3+
1.7.3 not yet released
4+
5+
packaging:
6+
* Fix LOCAL is set to installation folder when LOCAL is not used on MSI windows
7+
installation, and even if it was set empty in installer UI
8+
* Enhanced CVE-2024-28241 fix to only apply folder security if folder is not a
9+
subfolder of system "Program Files" folder
10+
311
1.7.2 Mon, 25 Mar 2024
412

513
packaging:

‎contrib/windows/glpi-agent-packaging.pl

+9-24
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
use File::Spec;
88
use Cwd qw(abs_path);
99
use File::Spec::Functions qw(catfile);
10+
use Data::UUID;
1011

1112
use constant {
1213
PACKAGE_REVISION => "1", #BEWARE: always start with 1
@@ -90,6 +91,7 @@ sub build_app {
9091
agent_vertag => $versiontag // '',
9192
agent_fullname => $provider.' Agent',
9293
agent_rootdir => $provider.'-Agent',
94+
agent_localguid => Data::UUID->new()->create_str(),
9395
agent_regpath => "Software\\$provider-Agent",
9496
service_name => lc($provider).'-agent',
9597
msi_sharedir => 'contrib/windows/packaging',
@@ -399,14 +401,14 @@ sub _tree2xml {
399401
$feat = $self->_get_dir_feature($dir_id);
400402
$result .= $ident ." ". qq[<Component Id="$component_id" Guid="{$component_guid}" KeyPath="yes" Feature="$feat">\n];
401403
if ($dir_id eq 'd_install') {
402-
$result .= $ident ." ". qq[ <CreateFolder>\n];
403-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="CREATOR OWNER" />\n];
404-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="LocalSystem" />\n];
405-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="Administrators" />\n];
406-
$result .= $ident ." ". qq[ <util:PermissionEx GenericWrite="no" GenericExecute="yes" GenericRead="yes" User="AuthenticatedUser" />\n];
407-
$result .= $ident ." ". qq[ </CreateFolder>\n];
404+
$result .= $ident ." ". qq[ <CreateFolder>\n];
405+
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="CREATOR OWNER" />\n];
406+
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="LocalSystem" />\n];
407+
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="Administrators" />\n];
408+
$result .= $ident ." ". qq[ <util:PermissionEx GenericWrite="no" GenericExecute="yes" GenericRead="yes" User="AuthenticatedUser" />\n];
409+
$result .= $ident ." ". qq[ </CreateFolder>\n];
408410
} else {
409-
$result .= $ident ." ". qq[ <CreateFolder />\n];
411+
$result .= $ident ." ". qq[ <CreateFolder />\n];
410412
}
411413
if ($dir_id eq 'd_var') {
412414
$result .= $ident ." ". qq[ <util:RemoveFolderEx On="uninstall" Property="UNINSTALL_VAR" />\n];
@@ -418,23 +420,6 @@ sub _tree2xml {
418420
$result .= $ident ." ". qq[ <RemoveFolder Id="rm.$dir_id" On="uninstall" />\n];
419421
}
420422
$result .= $ident ." ". qq[</Component>\n];
421-
# Also add virtual folder properties under d_install
422-
if ($dir_id eq 'd_install') {
423-
foreach my $id (qw(LOCAL)) {
424-
$result .= $ident ." ". qq[<Directory Id="$id">\n];
425-
($component_id, $component_guid) = $self->_gen_component_id(lc($id).".create");
426-
$result .= $ident ." ". qq[<Component Id="$component_id" Guid="{$component_guid}" KeyPath="yes" Feature="$feat">\n];
427-
$result .= $ident ." ". qq[ <CreateFolder>\n];
428-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="CREATOR OWNER" />\n];
429-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="LocalSystem" />\n];
430-
$result .= $ident ." ". qq[ <util:PermissionEx GenericAll="yes" User="Administrators" />\n];
431-
$result .= $ident ." ". qq[ <util:PermissionEx GenericWrite="no" GenericExecute="yes" GenericRead="yes" User="AuthenticatedUser" />\n];
432-
$result .= $ident ." ". qq[ </CreateFolder>\n];
433-
$result .= $ident ." ". qq[ <RemoveFolder Id="rm.] .lc($id). qq[" On="uninstall" />\n];
434-
$result .= $ident ." ". qq[</Component>\n];
435-
$result .= $ident ." ". qq[</Directory>\n];
436-
}
437-
}
438423
}
439424

440425
if (scalar(@f) > 0) {

‎contrib/windows/packaging/MSI_main-v2.wxs.tt

+26-7
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,9 @@
9595
<RegistrySearch Id="Local" Root="HKLM" Key="[%agent_regpath%]" Name="local" Type="raw"/>
9696
</Property>
9797
<SetProperty Id="CMDLINE_LOCAL" Before="AppSearch" Value="[LOCAL]" />
98-
<SetProperty Id="LOCAL" After="AppSearch" Value="[CMDLINE_LOCAL]"><![CDATA[CMDLINE_LOCAL<>"" OR CMDLINE_CONFIG="reset"]]></SetProperty>
98+
<!-- Also compare to ProgramFiles64Folder to fix wrongly set LOCAL in 1.7.2 -->
99+
<SetProperty Id="LOCAL" After="AppSearch" Value="[CMDLINE_LOCAL]"><![CDATA[CMDLINE_LOCAL<>"" OR LOCAL=INSTALLDIR OR CMDLINE_CONFIG="reset"]]></SetProperty>
100+
<SetDirectory Id="_LOCALDIR" Before="CostFinalize" Value="[LOCAL]" />
99101

100102
<Property Id="ADDITIONAL_CONTENT" Secure="yes">
101103
<RegistrySearch Id="AdditionalContent" Root="HKLM" Key="[%agent_regpath%]" Name="additional-content" Type="raw"/>
@@ -462,15 +464,19 @@
462464
<LaunchConditions Sequence="200" />
463465

464466
[%- IF bits==32 %]
465-
<Custom Action="SchedSecureObjects" After="CreateFolders"><![CDATA[NOT REMOVE~="ALL"]]></Custom>
467+
<Custom Action="SchedSecureObjects" After="CreateFolders"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
468+
<Custom Action="SetFixInstallDir" After="SchedSecureObjects"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
469+
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
470+
<Custom Action="SetFixLocalDir" After="SchedSecureObjects"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
471+
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
466472
[%- ELSE %]
467-
<Custom Action="SchedSecureObjects_x64" After="CreateFolders"><![CDATA[NOT REMOVE~="ALL"]]></Custom>
473+
<Custom Action="SchedSecureObjects_x64" After="CreateFolders"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
474+
<Custom Action="SetFixInstallDir" After="SchedSecureObjects_x64"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
475+
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
476+
<Custom Action="SetFixLocalDir" After="SchedSecureObjects_x64"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
477+
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
468478
[%- END %]
469-
<Custom Action="SetFixInstallDir" After="SchedSecureObjects"><![CDATA[NOT REMOVE~="ALL"]]></Custom>
470-
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT REMOVE~="ALL"]]></Custom>
471479
<Custom Action="UpdateLocalDir" Before="CostFinalize"><![CDATA[LOCAL<>"" AND NOT LOCAL>>"\" AND NOT REMOVE~="ALL"]]></Custom>
472-
<Custom Action="SetFixLocalDir" After="SchedSecureObjects"><![CDATA[LOCAL<>"" AND NOT REMOVE~="ALL"]]></Custom>
473-
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT REMOVE~="ALL"]]></Custom>
474480

475481
<!-- Schedule custom action to always remove windows task if exists -->
476482
<Custom Action="SetEndTask" Before="EndTask" />
@@ -1030,6 +1036,19 @@
10301036
</Directory> <!-- INSTALLDIR -->
10311037
</Directory> <!-- ProgramFilesFolder -->
10321038

1039+
<Directory Id="_LOCALDIR">
1040+
<Component Id="LocalDir" Guid="$(var.LocalDirGuid)" KeyPath="yes" Feature="feat_AGENT">
1041+
<CreateFolder>
1042+
<util:PermissionEx GenericAll="yes" User="CREATOR OWNER" />
1043+
<util:PermissionEx GenericAll="yes" User="LocalSystem" />
1044+
<util:PermissionEx GenericAll="yes" User="Administrators" />
1045+
<util:PermissionEx GenericExecute="yes" GenericRead="yes" User="AuthenticatedUser" />
1046+
</CreateFolder>
1047+
<RemoveFolder Id="rm.local" On="uninstall" />
1048+
<Condition><![CDATA[LOCAL<>""]]></Condition>
1049+
</Component>
1050+
</Directory>
1051+
10331052
<Directory Id="ProgramMenuFolder" />
10341053

10351054
</Directory> <!-- TARGETDIR -->

‎contrib/windows/packaging/Variables-v2.wxi.tt

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
<?define URLAbout = "[%url_about%]" ?> <!-- e.g. "https://glpi-project.org/" -->
1616
<?define URLHelp = "[%url_help%]" ?> <!-- e.g. "https://glpi-project.org/discussions/" -->
1717
<?define RootDir = "[%agent_rootdir%]" ?> <!-- e.g. "GLPI-Agent" -->
18+
<?define LocalDirGuid = "[%agent_localguid%]" ?>
1819

1920
<?define FileMainIcon = "[%msi_main_icon%]" ?>
2021
<?define FileLicenseRtf = "[%msi_license_rtf%]" ?>

0 commit comments

Comments
 (0)