makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #69 from phpbb/ticket/security-279

Browse source 
[ticket/security/279] Escape smilies URL and prevent paths in .pak filename
This commit is contained in:
Marc Alexander 2023-10-15 13:50:41 +02:00
commit ccf6e6c255
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
phpBB/includes/acp/acp_icons.php
View file

@ -550,7 +550,7 @@ class acp_icons
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
} }
if (!($pak_ary = @file($phpbb_root_path . $img_path . '/' . $pak))) if (!($pak_ary = @file($phpbb_root_path . $img_path . '/' . utf8_basename($pak))))
{ {
trigger_error($user->lang['PAK_FILE_NOT_READABLE'] . adm_back_link($this->u_action), E_USER_WARNING); trigger_error($user->lang['PAK_FILE_NOT_READABLE'] . adm_back_link($this->u_action), E_USER_WARNING);
} }
@ -654,7 +654,7 @@ class acp_icons
{ {
$replace_sql = ($mode == 'smilies') ? $code : $img; $replace_sql = ($mode == 'smilies') ? $code : $img;
$sql = array( $sql = array(
$fields . '_url' => $img, $fields . '_url' => utf8_substr(rawurlencode($img), 0, 50),
$fields . '_height' => (int) $height, $fields . '_height' => (int) $height,
$fields . '_width' => (int) $width, $fields . '_width' => (int) $width,
'display_on_posting' => (int) $display_on_posting, 'display_on_posting' => (int) $display_on_posting,
@ -676,7 +676,7 @@ class acp_icons
++$order; ++$order;
$sql = array( $sql = array(
$fields . '_url' => $img, $fields . '_url' => utf8_substr(rawurlencode($img), 0, 50),
$fields . '_height' => (int) $height, $fields . '_height' => (int) $height,
$fields . '_width' => (int) $width, $fields . '_width' => (int) $width,
$fields . '_order' => (int) $order, $fields . '_order' => (int) $order,