mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed #7896 Made sure only images could be uploaded and validated on the server to make sure it is an image and not something else.

Browse Source
This commit is contained in:
Stephen Jones 2017-11-15 16:07:25 -06:00
parent 48f08ba1e6
commit 00fc2d5eee
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/usr/local/www/widgets/widgets/picture.widget.php
View File

@ -25,6 +25,7 @@ require_once("guiconfig.inc");
require_once("pfsense-utils.inc");
require_once("functions.inc");
if ($_GET['getpic']=="true") {
$pic_type_s = explode(".", $user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']);
$pic_type = $pic_type_s[1];
@ -40,7 +41,6 @@ if ($_GET['getpic']=="true") {
if ($_POST['widgetkey']) {
set_customwidgettitle($user_settings);
if (is_uploaded_file($_FILES['pictfile']['tmp_name'])) {
/* read the file contents */
$fd_pic = fopen($_FILES['pictfile']['tmp_name'], "rb");
@ -53,6 +53,14 @@ if ($_POST['widgetkey']) {
log_error("Warning, could not read file " . $_FILES['pictfile']['tmp_name']);
die("Could not read temporary file");
} else {
// Make sure they upload an image and not some other file
$img_info =getimagesize($_FILES['pictfile']['tmp_name']);
if($img_info === FALSE){
die("Unable to determine image type of uploaded file");
}
if(($img_info[2] !== IMAGETYPE_GIF) && ($img_info[2] !== IMAGETYPE_JPEG) && ($img_info[2] !== IMAGETYPE_PNG)){
die("Not a gif/jpg/png");
}
$picname = basename($_FILES['uploadedfile']['name']);
$user_settings['widgets'][$_POST['widgetkey']]['picturewidget'] = base64_encode($data);
$user_settings['widgets'][$_POST['widgetkey']]['picturewidget_filename'] = $_FILES['pictfile']['name'];
@ -66,14 +74,14 @@ if ($_POST['widgetkey']) {
?>
<?php
if($user_settings['widgets'][$widgetkey] != null){?>
if($user_settings['widgets'][$widgetkey]["picturewidget"] != null){?>
<a href="/widgets/widgets/picture.widget.php?getpic=true&widgetkey=<?=htmlspecialchars($widgetkey)?>" target="_blank">
<img style="width:100%; height:100%" src="/widgets/widgets/picture.widget.php?getpic=true&widgetkey=<?=htmlspecialchars($widgetkey)?>" alt="picture" />
</a>
<?php } ?>
<!-- close the body we're wrapped in and add a configuration-panel -->
</div><div id="<?=$widget_panel_footer_id?>"
<?php echo "class= " . "'" . "panel-footer". ($user_settings['widgets'][$widgetkey] != null ? " collapse": ""). "'"; ?>>
<?php echo "class= " . "'" . "panel-footer". ($user_settings['widgets'][$widgetkey]["picturewidget"] != null ? " collapse": ""). "'"; ?>>
<form action="/widgets/widgets/picture.widget.php" method="post" enctype="multipart/form-data" class="form-horizontal">
<input type="hidden" name="widgetkey" value="<?=htmlspecialchars($widgetkey); ?>">
@ -81,7 +89,7 @@ if($user_settings['widgets'][$widgetkey] != null){?>
<div class="form-group">
<label for="pictfile" class="col-sm-4 control-label"><?=gettext('New picture:')?> </label>
<div class="col-sm-6">
<input id="pictfile" name="pictfile" type="file" class="form-control" />
<input id="pictfile" name="pictfile" type="file" class="form-control" accept="image/*"/>
</div>
</div>
<div class="form-group">