From 98799ea173690dd76b0d8bdbab3a04f1ede2f2ed Mon Sep 17 00:00:00 2001 From: nicolaasuni Date: Sat, 22 Sep 2018 10:37:08 +0100 Subject: [PATCH] Simplify file_exists function --- CHANGELOG.TXT | 5 ++++- composer.json | 2 +- include/tcpdf_static.php | 18 +++--------------- tcpdf.php | 6 +++--- 4 files changed, 11 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.TXT b/CHANGELOG.TXT index fc0bb41..5843efb 100644 --- a/CHANGELOG.TXT +++ b/CHANGELOG.TXT @@ -1,4 +1,7 @@ -6.2.20 +6.2.23 + - Simplify file_exists function. + +6.2.22 - Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data. 6.2.19 diff --git a/composer.json b/composer.json index df1e50d..bff3133 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { "name": "tecnickcom/tcpdf", - "version": "6.2.22", + "version": "6.2.23", "homepage": "http://www.tcpdf.org/", "type": "library", "description": "TCPDF is a PHP class for generating PDF documents and barcodes.", diff --git a/include/tcpdf_static.php b/include/tcpdf_static.php index b010f7a..3e24597 100644 --- a/include/tcpdf_static.php +++ b/include/tcpdf_static.php @@ -55,7 +55,7 @@ class TCPDF_STATIC { * Current TCPDF version. * @private static */ - private static $tcpdf_version = '6.2.22'; + private static $tcpdf_version = '6.2.23'; /** * String alias for total number of pages. @@ -1830,20 +1830,8 @@ class TCPDF_STATIC { * @public static */ public static function file_exists($filename) { - if (strpos($filename, '://') > 0) { - $wrappers = stream_get_wrappers(); - foreach ($wrappers as $wrapper) { - if (($wrapper === 'http') || ($wrapper === 'https')) { - continue; - } - if (stripos($filename, $wrapper.'://') === 0) { - return false; - } - } - } - if (!@file_exists($filename)) { - // try to encode spaces on filename - $filename = str_replace(' ', '%20', $filename); + if (strpos($filename, '://') && (preg_match('|^https?://|', $filename) !== 1)) { + return false; } return @file_exists($filename); } diff --git a/tcpdf.php b/tcpdf.php index b2c8ceb..998adfb 100644 --- a/tcpdf.php +++ b/tcpdf.php @@ -1,7 +1,7 @@ * @package com.tecnick.tcpdf * @author Nicola Asuni - * @version 6.2.22 + * @version 6.2.23 */ // TCPDF configuration @@ -128,7 +128,7 @@ require_once(dirname(__FILE__).'/include/tcpdf_static.php'); * TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.
* @package com.tecnick.tcpdf * @brief PHP class for generating PDF documents without requiring external extensions. - * @version 6.2.22 + * @version 6.2.23 * @author Nicola Asuni - info@tecnick.com * @IgnoreAnnotation("protected") * @IgnoreAnnotation("public")