mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

Ensure to not be able to call s9y files under circumstances where .htaccess does not deny request AND register_globals is turned on

Browse Source
This commit is contained in:
Garvin Hicking
2006-11-30 21:34:29 +00:00
parent e5014b2b78
commit f03841587a
23 changed files with 164 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
include/functions_images.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_IMAGES')) {
return;
}
@ -3315,15 +3319,15 @@ function serendipity_checkDirUpload($dir) {
return true;
}
*/
$allowed = serendipity_ACLGet(0, 'directory', 'write', $dir);
$mygroups = serendipity_checkPermission(null, null, true);
// Usergroup "0" always means that access is granted. If no array exists, no ACL restrictions have been set and all is fine.
if (!is_array($allowed) || isset($allowed[0])) {
return true;
}
if (!is_array($mygroups)) {
return true;
}
@ -3334,6 +3338,6 @@ function serendipity_checkDirUpload($dir) {
break;
}
}
return false;
}