mirror of
https://github.com/EGroupware/egroupware.git
synced 2024-11-07 08:34:29 +01:00
be less restrictive with file-names, e.g. allow brackets
This commit is contained in:
parent
fc1d641093
commit
d87ef46eea
@ -31,7 +31,7 @@ function send_image()
|
||||
|
||||
if (!file_exists($path) || empty($_GET['src']) ||
|
||||
basename($_GET['src']) !== $_GET['src'] || // make sure no directory traversal
|
||||
!preg_match('/^[a-z 0-9._-]+\.(jpe?g|png|gif|svg|ico|woff2)$/i', $_GET['src']) || // only allow images, not eg. Javascript!
|
||||
!preg_match('/^[^\/]+\.(jpe?g|png|gif|svg|ico|woff2)$/i', $_GET['src']) || // only allow images, not eg. Javascript!
|
||||
!file_exists($path .= '/' . $_GET['src']) ||
|
||||
!($fp = fopen($path, 'r')))
|
||||
{
|
||||
|
Loading…
Reference in New Issue
Block a user