lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FIX #yogosha6944 Protection against traversal path.

Browse Source
This commit is contained in:
Laurent Destailleur 2021-08-23 16:03:34 +02:00
parent cd141373fb
commit edb239837c
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/document.php
View File

@ -194,7 +194,7 @@ if (!in_array($type, array('text/x-javascript')) && !dolIsAllowedForPreview($ori
$type = 'application/octet-stream'; $type = 'application/octet-stream';
} }
// Security: Delete string ../ into $original_file // Security: Delete string ../ or ..\ into $original_file
$original_file = str_replace('../', '/', $original_file); $original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file); $original_file = str_replace('..\\', '/', $original_file);

5
htdocs/viewimage.php
View File

@ -221,8 +221,9 @@ if (preg_match('/\.noexe$/i', $original_file)) {
accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.', 0, 0, 1); accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.', 0, 0, 1);
} }
// Security: Delete string ../ into $original_file // Security: Delete string ../ or ..\ into $original_file
$original_file = str_replace("../", "/", $original_file); $original_file = str_replace('../', '/', $original_file);
$original_file = str_replace('..\\', '/', $original_file);
// Find the subdirectory name as the reference // Find the subdirectory name as the reference
$refname = basename(dirname($original_file)."/"); $refname = basename(dirname($original_file)."/");