Changeset 1143

Timestamp:

12/21/08 05:04:08 (4 years ago)

Author:

gogo

Message:

Security patch - see ticket:1363

Location:

trunk/plugins

Files:

• ExtendedFileManager/config.inc.php (modified) (1 diff)
• ExtendedFileManager/demo_images/.htaccess (modified) (1 diff)
• ImageManager/Classes/ImageEditor.php (modified) (1 diff)
• ImageManager/Classes/ImageManager.php (modified) (1 diff)
• ImageManager/config.inc.php (modified) (2 diffs)
• ImageManager/demo_images/.htaccess (added)

trunk/plugins/ExtendedFileManager/config.inc.php

@@ -281 +281 @@
   FALSE - No uploading allowed.
 */
-$IMConfig['allow_upload'] = true;
+$IMConfig['allow_upload'] = false;
 
 /* Maximum upload file size

trunk/plugins/ExtendedFileManager/demo_images/.htaccess

@@ -1 @@
-php_flag engine off
+<IfModule mod_php.c>
+  php_flag engine off
+</IfModule>
 AddType text/html .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi

trunk/plugins/ImageManager/Classes/ImageEditor.php

@@ -260 +260 @@
                         Return $base.'.gif';
 
+    // Ensure type is in acceptable image types
+    $valid_extensions = $this->manager->config['allowed_image_extensions'];    
+    if(!in_array($ext, $valid_extensions))
+                {
+      return $base . ".".strtolower($type ? $type : 'jpg');
+                }
+    
                 Return $filename;
         }

trunk/plugins/ImageManager/Classes/ImageManager.php

@@ -456 +456 @@
                                 Return false;
                         }
+                }
+    
+    $valid_extensions = $this->config['allowed_image_extensions'];
+    $afruext = strtolower(substr(strrchr($file['name'], "."), 1));
+    if(!in_array($afruext, $valid_extensions))
+                {
+                        Files::delFile($file['tmp_name']);
+                        Return 'Cannot upload $extension='.$afruext.'$ Files. Permission denied.';
                 }
 

trunk/plugins/ImageManager/config.inc.php

@@ -229 +229 @@
 */
 
-$IMConfig['allow_upload'] = true;
+$IMConfig['allow_upload'] = false;
 
 // -------------------------------------------------------------------------
@@ -248 +248 @@
 
 $IMConfig['validate_images'] = true;
+
+$IMConfig['allowed_image_extensions'] = array("jpg","gif","png","jpeg");
 
 // -------------------------------------------------------------------------