oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix - [ 1403466 ] CS Attachments - Broken Image Issue

Browse source
This commit is contained in:
Matthew Wilson 2006-01-12 03:16:28 +00:00
parent 925906ca7e
commit c250321c4c
3 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog/6.x.x.txt
View file

@ -4,6 +4,7 @@
6.8.5
- fix [ 1396957 ] Insufficient privileges check on the DataForm
- fix [ 1403466 ] CS Attachments - Broken Image Issue
6.8.4
- fix [ 1395371 ] XSS Vulnerability in DataForm Entries

1
lib/WebGUI/Asset/Shortcut.pm
View file

@ -618,7 +618,6 @@ sub view {
foreach my $prop (keys %{$self->{_shortcut}{_properties}}) {
next if ($prop eq 'content' || $prop eq 'label' || $prop eq 'url');
$var{'shortcut.'.$prop} = $self->{_shortcut}{_properties}{$prop};
$self->session->errorHandler->warn($prop.' = '.$self->{_shortcut}{_properties}{$prop});
}
return $self->processTemplate(\%var,$self->getValue("templateId"));
}

14
lib/WebGUI/Storage.pm
View file

@ -203,15 +203,15 @@ sub addFileFromFormPost {
my $attachmentCount = 1;
foreach my $upload ($self->session->request->upload($formVariableName)) {
return $filename if $attachmentCount > $attachmentLimit;
$filename = $upload->filename();
next unless $filename;
if ($filename =~ /([^\/\\]+)$/) { $filename = $1; }
my $type = $self->getFileExtension($filename);
my $tempFilename = $upload->filename();
next unless $tempFilename;
if ($tempFilename =~ /([^\/\\]+)$/) { $tempFilename = $1; }
my $type = $self->getFileExtension($tempFilename);
if (isIn($type, qw(pl perl sh cgi php asp))) { # make us safe from malicious uploads
$filename =~ s/\./\_/g;
$filename .= ".txt";
$tempFilename =~ s/\./\_/g;
$tempFilename .= ".txt";
}
$filename = $self->session->url->makeCompliant($filename);
$filename = $self->session->url->makeCompliant($tempFilename);
my $bytesread;
my $file = FileHandle->new(">".$self->getPath($filename));
$attachmentCount++;