Beanz/flatpress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

check for correct admin referer on deletefile (see #64)

Browse Source
This commit is contained in:
azett 2022-12-29 15:01:49 +01:00
parent d8991285c6
commit 88494f5526
3 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fp-includes/core/core.wp-pluggable-funcs.php
View File

@ -335,7 +335,8 @@ if (!function_exists('wp_verify_nonce')) :
$i = ceil(time() / (60 * 60 * 12)); $i = ceil(time() / (60 * 60 * 12));
// Allow for expanding range, but only do one check if we can // Allow for expanding range, but only do one check if we can
if (substr(wp_hash($i . $action . $uid), -12, 10) == $nonce || substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce) $expectedNonce = substr(wp_hash($i . $action . $uid), -12, 10);
if ($expectedNonce == $nonce || substr(wp_hash(($i - 1) . $action . $uid), -12, 10) == $nonce)
return true; return true;
return false; return false;
} }

5
fp-plugins/mediamanager/panels/panel.mediamanager.file.php
View File

@ -74,8 +74,13 @@ class admin_uploader_mediamanager extends AdminPanelAction {
} }
function doItemActions($folder, $mmbaseurl) { function doItemActions($folder, $mmbaseurl) {
/* delete file */ /* delete file */
if (isset($_GET ['deletefile'])) { if (isset($_GET ['deletefile'])) {
// at first: check if nonce was given correctly
check_admin_referer('mediamanager_deletefile');
// now get the file to be deleted
list ($type, $name) = explode("-", $_GET ['deletefile'], 2); list ($type, $name) = explode("-", $_GET ['deletefile'], 2);
// prevent path traversal: remove ".." and "/" resp. "\" // prevent path traversal: remove ".." and "/" resp. "\"
$name = preg_replace('(\.\.|\/|\\\\)', '', $name); $name = preg_replace('(\.\.|\/|\\\\)', '', $name);

4
fp-plugins/mediamanager/tpls/admin.plugin.mediamanager.files.tpl
View File

@ -43,7 +43,7 @@
<td>{$v.size}</td> <td>{$v.size}</td>
<td>{$v.mtime}</td> <td>{$v.mtime}</td>
<td> <td>
<a class="link-delete" href="{$mmbaseurl}&deletefile={$v.type}-{$v.name}">{$plang.delete}</a> <a class="link-delete" href="{wp_nonce_url("{$mmbaseurl}&deletefile={$v.type}-{$v.name}", 'mediamanager_deletefile')}">{$plang.delete}</a>
</td> </td>
</tr> </tr>
{/foreach} {/foreach}
@ -70,7 +70,7 @@
<td>{$v.size}</td> <td>{$v.size}</td>
<td>{$v.mtime}</td> <td>{$v.mtime}</td>
<td> <td>
<a class="link-delete" href="{$mmbaseurl}&deletefile={$v.type}-{$v.name}">{$plang.delete}</a> <a class="link-delete" href="{wp_nonce_url("{$mmbaseurl}&deletefile={$v.type}-{$v.name}", 'mediamanager_deletefile')}">{$plang.delete}</a>
</td> </td>
</tr> </tr>
{/foreach} {/foreach}