mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-02-24 03:54:10 +01:00
Code Issues Releases Wiki Activity

[feature/attach-dl] Remove attachments that have invalid extensions

Browse Source 
PHPBB3-11042
This commit is contained in:
Fyorl 2012-08-14 12:03:07 +01:00
parent 20ecd046da
commit d08c1c23dc
1 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
phpBB/download/file.php
View File

@ -352,14 +352,14 @@ else
} }
else else
{ {
$sql = 'SELECT post_subject $sql = 'SELECT post_subject, forum_id
FROM ' . POSTS_TABLE . " FROM ' . POSTS_TABLE . "
WHERE post_id = $post_id"; WHERE post_id = $post_id";
} }
} }
else else
{ {
$sql = 'SELECT topic_title $sql = 'SELECT topic_title, forum_id
FROM ' . TOPICS_TABLE . " FROM ' . TOPICS_TABLE . "
WHERE topic_id = $topic_id"; WHERE topic_id = $topic_id";
} }
@ -389,8 +389,19 @@ else
$compress = new compress_tar('w', "{$phpbb_root_path}store/{$store_name}{$archive}", $archive); $compress = new compress_tar('w', "{$phpbb_root_path}store/{$store_name}{$archive}", $archive);
} }
$extensions = array();
$count = 0;
$forum_id = ($attachment['in_message']) ? false : $row['forum_id'];
$disallowed = array();
foreach ($attachments as $attach) foreach ($attachments as $attach)
{ {
if (!extension_allowed($forum_id, $attach['extension'], $extensions))
{
$disallowed[$attach['extension']] = 1;
continue;
}
$prefix = ''; $prefix = '';
if ($topic_id) if ($topic_id)
{ {
@ -398,11 +409,26 @@ else
} }
$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}"); $compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}");
$count++;
} }
$compress->close(); $compress->close();
phpbb_increment_downloads($db, $attachment_ids);
$compress->download($store_name, $archive_name); if ($count > 0)
{
phpbb_increment_downloads($db, $attachment_ids);
$compress->download($store_name, $archive_name);
}
unlink("{$phpbb_root_path}store/{$store_name}{$archive}"); unlink("{$phpbb_root_path}store/{$store_name}{$archive}");
if ($count < 1)
{
// None of the attachments had a valid a extension
$disallowed = implode(', ', array_keys($disallowed));
send_status_line(404, 'Forbidden');
trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $disallowed));
}
file_gc(); file_gc();
} }