From d8ac6f575ef719e89509d5e26fab608e6b0dfce0 Mon Sep 17 00:00:00 2001 From: Derky Date: Mon, 18 Sep 2023 20:12:41 +0200 Subject: [PATCH] [ticket/security/279] Escape smilies URL and prevent paths in .pak filename SECURITY-279 --- phpBB/includes/acp/acp_icons.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/phpBB/includes/acp/acp_icons.php b/phpBB/includes/acp/acp_icons.php index 4758e89a93..642e9cf06e 100644 --- a/phpBB/includes/acp/acp_icons.php +++ b/phpBB/includes/acp/acp_icons.php @@ -550,7 +550,7 @@ class acp_icons trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); } - if (!($pak_ary = @file($phpbb_root_path . $img_path . '/' . $pak))) + if (!($pak_ary = @file($phpbb_root_path . $img_path . '/' . basename($pak)))) { trigger_error($user->lang['PAK_FILE_NOT_READABLE'] . adm_back_link($this->u_action), E_USER_WARNING); } @@ -654,7 +654,7 @@ class acp_icons { $replace_sql = ($mode == 'smilies') ? $code : $img; $sql = array( - $fields . '_url' => $img, + $fields . '_url' => utf8_substr(htmlspecialchars($img, ENT_COMPAT), 0, 50), $fields . '_height' => (int) $height, $fields . '_width' => (int) $width, 'display_on_posting' => (int) $display_on_posting, @@ -676,7 +676,7 @@ class acp_icons ++$order; $sql = array( - $fields . '_url' => $img, + $fields . '_url' => utf8_substr(htmlspecialchars($img, ENT_COMPAT), 0, 50), $fields . '_height' => (int) $height, $fields . '_width' => (int) $width, $fields . '_order' => (int) $order,