archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixes #488 make user input watermark filename safe (#492)

Browse source
This commit is contained in:
jeremydurand 2016-06-02 11:17:57 +02:00 committed by Pierrick Le Gall
parent 022bfd2493
commit 43ecfbf60a
1 changed files with 32 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
admin/include/configuration_watermark_process.inc.php
View file

@ -26,6 +26,21 @@ if( !defined("PHPWG_ROOT_PATH") )
die ("Hacking attempt!");
}
function get_watermark_filename($list, $candidate, $step = 0)
{
global $change_name;
$change_name = $candidate;
if ($step != 0)
{
$change_name .= '-'.$step;
}
if (in_array($change_name, $list))
{
return get_watermark_filename($list, $candidate, $step+1);
}
return $change_name.'.png';
}
$errors = array();
$pwatermark = $_POST['w'];
@ -45,8 +60,22 @@ if (isset($_FILES['watermarkImage']) and !empty($_FILES['watermarkImage']['tmp_n
$upload_dir = PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks';
if (mkgetdir($upload_dir, MKGETDIR_DEFAULT&~MKGETDIR_DIE_ON_ERROR))
{
$new_name = get_filename_wo_extension($_FILES['watermarkImage']['name']).'.png';
$file_path = $upload_dir.'/'.$new_name;
// file name may include exotic chars like single quote, we need a safe name
$new_name = str2url(get_filename_wo_extension($_FILES['watermarkImage']['name']));
// we need existing watermarks to avoid overwritting one
$watermark_files = array();
if ( ($glob=glob(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks/*.png')) !== false)
{
foreach ($glob as $file)
{
$watermark_files[] = get_filename_wo_extension(
substr($file, strlen(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks/'))
);
}
}
$file_path = $upload_dir.'/'.get_watermark_filename($watermark_files, $new_name);
if (move_uploaded_file($_FILES['watermarkImage']['tmp_name'], $file_path))
{
@ -183,4 +212,4 @@ else
$template->assign('watermark', $pwatermark);
$template->assign('ferrors', $errors);
}
?>
?>