mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Image upload validation improvements. Fixes #9804

Browse Source 
* Make functions for validating images against a pre-defined list of
approved types
* Change the picture widget to use these functions
* Add validation for uploaded Captive Portal logo/background images
This commit is contained in:
jim-p 2019-10-01 12:10:31 -04:00
parent eacc805e0e
commit 09d597434c
3 changed files with 40 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/etc/inc/util.inc
View File

@ -2907,4 +2907,25 @@ function dhcpd_date_adjust_gmt($dt) {
return $dt;
}
global $supported_image_types;
$supported_image_types = array(
IMAGETYPE_JPEG,
IMAGETYPE_PNG,
IMAGETYPE_GIF,
IMAGETYPE_WEBP
);
function is_supported_image($image_filename) {
global $supported_image_types;
$img_info = getimagesize($image_filename);
/* If it's not an image, or it isn't in the supported list, return false */
if (($img_info === false) ||
!in_array($img_info[2], array_keys($supported_image_types))) {
return false;
} else {
return $img_info[2];
}
}
?>

17
src/usr/local/www/services_captiveportal.php
View File

@ -311,6 +311,14 @@ if ($_POST['save']) {
if (trim($_POST['radiusnasid']) !== "" && !preg_match("/^[\x21-\x7e]{3,253}$/i", trim($_POST['radiusnasid']))) {
$input_errors[] = gettext("The NAS-Identifier must be 3-253 characters long and should only contain ASCII characters.");
}
if (is_uploaded_file($_FILES['logo-img']['tmp_name']) &&
(is_supported_image($_FILES['logo-img']['tmp_name']) === false)) {
$input_errors[] = gettext("Unsupported logo image type.");
}
if (is_uploaded_file($_FILES['background-img']['tmp_name']) &&
(is_supported_image($_FILES['background-img']['tmp_name']) === false)) {
$input_errors[] = gettext("Unsupported background image type.");
}
if (!$input_errors) {
init_config_arr(array('captiveportal', $cpzone));
@ -426,8 +434,9 @@ if ($_POST['save']) {
// Check for uploaded images for the default CP login
if (is_uploaded_file($_FILES['logo-img']['tmp_name'])) {
$ext = pathinfo($_FILES['logo-img']['name'],PATHINFO_EXTENSION);
$logo_name = "captiveportal-logo." . $ext;
/* Validated above, so returned value is OK */
$logo_name = "captiveportal-logo." . image_type_to_extension(is_supported_image($_FILES['logo-img']['tmp_name']));
for ($i = 0; $i < count($a_cp[$cpzone]['element']); $i++) {
if (strpos($a_cp[$cpzone]['element'][$i]['name'], "captiveportal-logo.") !== false){
// remove old image before replacing it.
@ -447,8 +456,8 @@ if ($_POST['save']) {
move_uploaded_file( $_FILES['logo-img']['tmp_name'], $target);
}
if (is_uploaded_file($_FILES['background-img']['tmp_name'])) {
$ext = pathinfo($_FILES['background-img']['name'],PATHINFO_EXTENSION);
$background_name = "captiveportal-background." . $ext;
/* Validated above, so returned value is OK */
$background_name = "captiveportal-background." . image_type_to_extension(is_supported_image($_FILES['background-img']['tmp_name']));
// is there already a file with that name?
for ($i = 0; $i < count($a_cp[$cpzone]['element']); $i++) {
if (strpos($a_cp[$cpzone]['element'][$i]['name'], "captiveportal-background.") !== false){

27
src/usr/local/www/widgets/widgets/picture.widget.php
View File

@ -38,20 +38,9 @@ if ($_GET['getpic']=="true") {
}
/* Do not rely on filename to determine image type. */
$img_info =getimagesize($image_filename);
switch ($img_info[2]) {
case IMAGETYPE_GIF:
$pic_type = "gif";
break;
case IMAGETYPE_JPEG:
$pic_type = "jpg";
break;
case IMAGETYPE_PNG:
$pic_type = "png";
break;
default:
echo null;
exit;
$pic_type = is_supported_image($image_filename);
if (empty($pic_type)) {
exit;
}
if ($user_settings['widgets'][$wk]['picturewidget']) {
@ -63,7 +52,7 @@ if ($_GET['getpic']=="true") {
}
header("Content-Disposition: inline; filename=\"" . basename($image_filename) . "\"");
header("Content-Type: image/{$pic_type}");
header("Content-Type: " . image_type_to_mime_type($pic_type));
header("Content-Length: " . strlen($data));
echo $data;
exit;
@ -88,12 +77,8 @@ if ($_POST['widgetkey']) {
die("Could not read temporary file");
} else {
// Make sure they upload an image and not some other file
$img_info =getimagesize($_FILES['pictfile']['tmp_name']);
if($img_info === FALSE){
die("Unable to determine image type of uploaded file");
}
if(($img_info[2] !== IMAGETYPE_GIF) && ($img_info[2] !== IMAGETYPE_JPEG) && ($img_info[2] !== IMAGETYPE_PNG)){
die("Not a gif/jpg/png");
if (!is_supported_image($_FILES['pictfile']['tmp_name'])) {
die("Not a supported image type");
}
$picname = basename($_FILES['uploadedfile']['name']);
$user_settings['widgets'][$wk]['picturewidget'] = "/conf/widget_image";