Beanz/flatpress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: PHP files can not be uploaded any more - see https://www.exploit-db.com/exploits/39870

Browse Source
This commit is contained in:
azett 2018-12-31 15:13:49 +01:00
parent 1415afc6b1
commit 082c113d67
1 changed files with 90 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
admin/panels/uploader/admin.uploader.php
View File

@ -13,14 +13,20 @@
* *
*/ */
class admin_uploader extends AdminPanel { class admin_uploader extends AdminPanel {
var $panelname = 'uploader';
var $actions = array('default'=>true);
}
var $panelname = 'uploader';
var $actions = array(
'default' => true
);
}
class admin_uploader_default extends AdminPanelAction { class admin_uploader_default extends AdminPanelAction {
var $events = array('upload'); var $events = array(
'upload'
);
function main() { function main() {
if ($f = sess_remove('admin_uploader_files')) if ($f = sess_remove('admin_uploader_files'))
@ -28,7 +34,6 @@
} }
function onupload() { function onupload() {
$success = false; $success = false;
if (!file_exists(IMAGES_DIR)) if (!file_exists(IMAGES_DIR))
@ -37,8 +42,20 @@
if (!file_exists(ATTACHS_DIR)) if (!file_exists(ATTACHS_DIR))
fs_mkdir(ATTACHS_DIR); fs_mkdir(ATTACHS_DIR);
$imgs = array(
$imgs = array('.jpg','.gif','.png', '.jpeg'); '.jpg',
'.gif',
'.png',
'.jpeg'
);
$forbidden = array(
'.php',
'.php3',
'.php4',
'.php5',
'.php7',
'.phtml'
);
// intentionally // intentionally
// I've not put BMPs // I've not put BMPs
@ -55,6 +72,10 @@
$ext = strtolower(strrchr($name, '.')); $ext = strtolower(strrchr($name, '.'));
if (in_array($ext, $forbidden)) {
$success = false;
continue;
}
if (in_array($ext, $imgs)) { if (in_array($ext, $imgs)) {
$dir = IMAGES_DIR; $dir = IMAGES_DIR;
} }
@ -70,10 +91,7 @@
// one failure will make $success == false :) // one failure will make $success == false :)
$success &= $success; $success &= $success;
} }
} }
if ($uploaded_files) { if ($uploaded_files) {
@ -82,8 +100,8 @@
} }
return 1; return 1;
} }
} }
?> ?>