gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-09 13:06:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix security hole

Browse Source 
missing check of passed parameters allows to place files on the server
This commit is contained in:
Uwe Steinmann 2014-02-26 22:31:01 +01:00
parent 5886449b31
commit d317c744bf
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
op/op.AddFile2.php
View File

@ -28,14 +28,16 @@ include("../inc/inc.Authentication.php");
$file_param_name = 'file';
$file_name = $_FILES[ $file_param_name ][ 'name' ];
$source_file_path = $_FILES[ $file_param_name ][ 'tmp_name' ];
$target_file_path =$settings->_stagingDir.$_POST['fileId']."-".$_POST['partitionIndex'];
$fileId = basename($_POST['fileId']);
$partitionIndex = (int) $_POST['partitionIndex'];
$target_file_path =$settings->_stagingDir.$fileId."-".$partitionIndex;
if( move_uploaded_file( $source_file_path, $target_file_path ) ) {
if($_POST['partitionIndex']+1 == $_POST['partitionCount']) {
$fpnew = fopen($settings->_stagingDir.$_POST['fileId'], 'w+');
if($partitionIndex+1 == $_POST['partitionCount']) {
$fpnew = fopen($settings->_stagingDir.$fileId, 'w+');
for($i=0; $i<$_POST['partitionCount']; $i++) {
$content = file_get_contents($settings->_stagingDir.$_POST['fileId']."-".$i, 'r');
$content = file_get_contents($settings->_stagingDir.$fileId."-".$i, 'r');
fwrite($fpnew, $content);
unlink($settings->_stagingDir.$_POST['fileId']."-".$i);
unlink($settings->_stagingDir.$fileId."-".$i);
}
fclose($fpnew);
@ -56,7 +58,7 @@ if( move_uploaded_file( $source_file_path, $target_file_path ) ) {
echo getMLText("access_denied");
}
$userfiletmp = $settings->_stagingDir.$_POST['fileId'];;
$userfiletmp = $settings->_stagingDir.$fileId;
$userfiletype = $_FILES[ $file_param_name ]["type"];
$userfilename = $_FILES[ $file_param_name ]["name"];