mirror/php-tinyfilemanager
1
0
Fork 0
mirror of https://github.com/prasathmani/tinyfilemanager.git synced 2025-08-01 14:30:45 +02:00
Code Issues Releases Wiki Activity

Fix security issues #525 and #526

Browse Source
This commit is contained in:
Prasath Mani
2021-04-22 13:41:35 +05:30
parent 03c3f6d7f9
commit a04567d3ba
4 changed files with 122 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
tinyfilemanager.php
View File

@@ -3,13 +3,13 @@
$CONFIG = '{"lang":"en","error_reporting":false,"show_hidden":false,"hide_Cols":false,"calc_folder":false}';
/**
* H3K | Tiny File Manager V2.4.4
* H3K | Tiny File Manager V2.4.5
* CCP Programmers | ccpprogrammers@gmail.com
* https://tinyfilemanager.github.io
*/
//TFM version
define('VERSION', '2.4.4');
define('VERSION', '2.4.5');
//Application Title
define('APP_TITLE', 'Tiny File Manager');
@@ -526,17 +526,7 @@ if (isset($_POST['ajax']) && !FM_READONLY) {
$path .= '/' . FM_PATH;
}
$url = !empty($_REQUEST["uploadurl"]) && preg_match("|^http(s)?://.+$|", stripslashes($_REQUEST["uploadurl"])) ? stripslashes($_REQUEST["uploadurl"]) : null;
$use_curl = false;
$temp_file = tempnam(sys_get_temp_dir(), "upload-");
$fileinfo = new stdClass();
$fileinfo->name = trim(basename($url), ".\x00..\x20");
$allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;
$ext = strtolower(pathinfo($fileinfo->name, PATHINFO_EXTENSION));
$isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
function event_callback ($message) {
function event_callback ($message) {
global $callback;
echo json_encode($message);
}
@@ -546,6 +536,28 @@ if (isset($_POST['ajax']) && !FM_READONLY) {
return $path."/".basename($fileinfo->name);
}
$url = !empty($_REQUEST["uploadurl"]) && preg_match("|^http(s)?://.+$|", stripslashes($_REQUEST["uploadurl"])) ? stripslashes($_REQUEST["uploadurl"]) : null;
//prevent 127.* domain and known ports
$domain = parse_url($url, PHP_URL_HOST);
$port = parse_url($url, PHP_URL_PORT);
$knownPorts = [22, 23, 25, 3306];
if (preg_match("/^localhost$|^127(?:\.[0-9]+){0,2}\.[0-9]+$|^(?:0*\:)*?:?0*1$/i", $domain) || in_array($port, $knownPorts)) {
$err = array("message" => "URL is not allowed");
event_callback(array("fail" => $err));
exit();
}
$use_curl = false;
$temp_file = tempnam(sys_get_temp_dir(), "upload-");
$fileinfo = new stdClass();
$fileinfo->name = trim(basename($url), ".\x00..\x20");
$allowed = (FM_UPLOAD_EXTENSION) ? explode(',', FM_UPLOAD_EXTENSION) : false;
$ext = strtolower(pathinfo($fileinfo->name, PATHINFO_EXTENSION));
$isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
$err = false;
if(!$isFileAllowed) {
@@ -855,6 +867,14 @@ if (!empty($_FILES) && !FM_READONLY) {
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
$isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) {
$response = array (
'status' => 'error',
'info' => "Invalid File name!",
);
echo json_encode($response); exit();
}
$targetPath = $path . $ds;
if ( is_writable($targetPath) ) {
$fullPath = $path . '/' . $_REQUEST['fullpath'];