oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixed a phishing exploit. html and htm files are now renamed to have a .txt extenstion appended to them.

Browse source
This commit is contained in:
Roy Johnson 2006-12-16 22:16:30 +00:00
parent 36873f8479
commit 16e2ad99da
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/WebGUI/Storage.pm
View file

@ -208,7 +208,7 @@ sub addFileFromFormPost {
next if ($upload->size > 1024 * $self->session->setting->get("maxAttachmentSize"));
if ($tempFilename =~ /([^\/\\]+)$/) { $tempFilename = $1; }
my $type = $self->getFileExtension($tempFilename);
if (isIn($type, qw(pl perl sh cgi php asp))) { # make us safe from malicious uploads
if (isIn($type, qw(pl perl sh cgi php asp html htm))) { # make us safe from malicious uploads
$tempFilename =~ s/\./\_/g;
$tempFilename .= ".txt";
}