gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-09 13:06:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix security hole

Browse Source 
missing check of passed parameters allows to place files on the server
This commit is contained in:
Uwe Steinmann 2014-02-26 22:31:01 +01:00
parent 5886449b31
commit d317c744bf
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
op/op.AddFile2.php
View File

@ -28,14 +28,16 @@ include("../inc/inc.Authentication.php");
$file_param_name = 'file'; $file_param_name = 'file';
$file_name = $_FILES[ $file_param_name ][ 'name' ]; $file_name = $_FILES[ $file_param_name ][ 'name' ];
$source_file_path = $_FILES[ $file_param_name ][ 'tmp_name' ]; $source_file_path = $_FILES[ $file_param_name ][ 'tmp_name' ];
$target_file_path =$settings->_stagingDir.$_POST['fileId']."-".$_POST['partitionIndex']; $fileId = basename($_POST['fileId']);
$partitionIndex = (int) $_POST['partitionIndex'];
$target_file_path =$settings->_stagingDir.$fileId."-".$partitionIndex;
if( move_uploaded_file( $source_file_path, $target_file_path ) ) { if( move_uploaded_file( $source_file_path, $target_file_path ) ) {
if($_POST['partitionIndex']+1 == $_POST['partitionCount']) { if($partitionIndex+1 == $_POST['partitionCount']) {
$fpnew = fopen($settings->_stagingDir.$_POST['fileId'], 'w+'); $fpnew = fopen($settings->_stagingDir.$fileId, 'w+');
for($i=0; $i<$_POST['partitionCount']; $i++) { for($i=0; $i<$_POST['partitionCount']; $i++) {
$content = file_get_contents($settings->_stagingDir.$_POST['fileId']."-".$i, 'r'); $content = file_get_contents($settings->_stagingDir.$fileId."-".$i, 'r');
fwrite($fpnew, $content); fwrite($fpnew, $content);
unlink($settings->_stagingDir.$_POST['fileId']."-".$i); unlink($settings->_stagingDir.$fileId."-".$i);
} }
fclose($fpnew); fclose($fpnew);
@ -56,7 +58,7 @@ if( move_uploaded_file( $source_file_path, $target_file_path ) ) {
echo getMLText("access_denied"); echo getMLText("access_denied");
} }
$userfiletmp = $settings->_stagingDir.$_POST['fileId'];; $userfiletmp = $settings->_stagingDir.$fileId;
$userfiletype = $_FILES[ $file_param_name ]["type"]; $userfiletype = $_FILES[ $file_param_name ]["type"];
$userfilename = $_FILES[ $file_param_name ]["name"]; $userfilename = $_FILES[ $file_param_name ]["name"];