mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

[BUGFIX] [SECURITY] Fixes only logging to .log and.txt filetype extensions

Browse Source
This commit is contained in:
Garvin Hicking
2019-09-17 10:50:28 +02:00
parent 5ccaa9a855
commit 7ab1cf9091
3 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/NEWS
View File

@@ -1,10 +1,12 @@
Version 2.4-alpha1 ()
------------------------------------------------------------------------
* Fix autologin when using MySQL (thanks @Eike Rathke,
* Only allows .txt and .log files for spamblock logging.
Thanks to Gary O'Leary-Steele (CVE TBD)
* Fixes not properly displaying plugin save errors (validation)
* Fix autologin when using MySQL (thanks @Eike Rathke,
https://github.com/s9y/Serendipity/pull/632)
* Add plugin update notifications to the plugin update button and

1
plugins/serendipity_event_spamblock/lang_en.inc.php
View File

@@ -147,3 +147,4 @@
@define('PLUGIN_EVENT_SPAMBLOCK_SPAM', 'Spam');
@define('PLUGIN_EVENT_SPAMBLOCK_NOT_SPAM', 'Not spam');
@define('PLUGIN_EVENT_SPAMBLOCK_LOGFILE_VALIDATE', 'Only file extensions .log and .txt are allowed');

2
plugins/serendipity_event_spamblock/serendipity_event_spamblock.php
View File

@@ -353,6 +353,8 @@ class serendipity_event_spamblock extends serendipity_event
$propbag->add('name', PLUGIN_EVENT_SPAMBLOCK_LOGFILE);
$propbag->add('description', PLUGIN_EVENT_SPAMBLOCK_LOGFILE_DESC);
$propbag->add('default', $serendipity['serendipityPath'] . 'spamblock-%Y-%m-%d.log');
$propbag->add('validate', '@\.(log|txt)$@imsU');
$propbag->add('validate_error', PLUGIN_EVENT_SPAMBLOCK_LOGFILE_VALIDATE);
break;
case 'logtype':