lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX Force downlaod of file with .noexe as octet-stream mime type

Browse Source
This commit is contained in:
Laurent Destailleur 2019-09-24 13:30:04 +02:00
parent b5c5cc42fc
commit 9cfe1262bd
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/document.php
View File

@ -159,6 +159,8 @@ if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
$type = 'application/octet-stream';
if (GETPOST('type', 'alpha')) $type=GETPOST('type', 'alpha');
else $type=dol_mimetype($original_file);
// Security: Force to octet-stream if file is a dangerous file
if (preg_match('/\.noexe$/i', $original_file)) $type = 'application/octet-stream';
// Security: Delete string ../ into $original_file
$original_file = str_replace("../", "/", $original_file);
@ -215,7 +217,7 @@ if (! $accessallowed)
}
// Security:
// On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
// We refuse directory transversal change and pipes in file names
if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file))
{
dol_syslog("Refused to deliver file ".$fullpath_original_file);
@ -227,6 +229,7 @@ if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $full
clearstatcache();
$filename = basename($fullpath_original_file);
$filename = preg_replace('/\.noexe$/i', '', $filename);
// Output file on browser
dol_syslog("document.php download $fullpath_original_file filename=$filename content-type=$type");