mbirth/LuckyCoinkydink
1
0
Fork 0
Code Issues Pull Requests Activity

Enhanced media upload check to also check redirects for local files, thanks to Xu Yue (again!)

Browse Source
This commit is contained in:
Garvin Hicking 2016-11-02 12:18:49 +01:00
parent d7980e5f94
commit 26de428c18
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/NEWS
View File

@ -1,3 +1,9 @@
Version 2.1 ()
------------------------------------------------------------------------
* [Security] Enhanced media upload check to also check redirects
for local files, thanks to Xu Yue (again!)
Version 2.1-beta2 (September 26th, 2016)
------------------------------------------------------------------------

5
include/admin/images.inc.php
View File

@ -290,7 +290,10 @@ switch ($serendipity['GET']['adminAction']) {
// Fetch file
$fContent = $response->getBody();
if ($serendipity['POST']['imageimporttype'] == 'hotlink') {
$fUrl = $response->getEffectiveUrl();
if (!serendipity_url_allowed($fUrl)) {
$messages[] = sprintf('<span class="msg_error"><span class="icon-attention-circled"></span> ' . REMOTE_FILE_INVALID . "</span>\n", $fUrl);
} elseif ($serendipity['POST']['imageimporttype'] == 'hotlink') {
$tempfile = $serendipity['serendipityPath'] . $serendipity['uploadPath'] . '/hotlink_' . time();
$fp = fopen($tempfile, 'w');
fwrite($fp, $fContent);