added SVG to forbidden file types in order to prevent possible XSS - see https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24588/CVE-2022-24588.pdf

2022-12-17 14:39:15 +01:00 · 2022-12-17 14:39:15 +01:00 · 742f8b04f2
commit 742f8b04f2
parent c4cc70e7ea
1 changed files with 2 additions and 1 deletions
--- a/admin/panels/uploader/admin.uploader.php
+++ b/admin/panels/uploader/admin.uploader.php
@ -95,7 +95,8 @@ class admin_uploader_default extends AdminPanelAction {
 			'jsp',
 			'htm',
 			'html',
-			'wml'
+			'wml',
+			'svg'
 		);

 		$imgs = array(