mirror_php/TCPDF
1
0
Fork 0
mirror of https://github.com/tecnickcom/TCPDF.git synced 2025-04-04 22:32:25 +02:00
Code Issues Projects Releases Wiki Activity

Do not allow stream wrappers other than http and https in file paths

Browse Source
This commit is contained in:
Leo Feyer 2018-09-11 10:13:29 +02:00
parent 64fc194398
commit 9f0350dca7
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tcpdf.php
View File

@ -6840,6 +6840,15 @@ class TCPDF {
// image from string
$imgdata = substr($file, 1);
} else { // image file
$wrappers = stream_get_wrappers();
foreach ($wrappers as $wrapper) {
if ($wrapper === 'http' || $wrapper === 'https') {
continue;
}
if (strpos($file, $wrapper.'://') === 0) {
$this->Error('Stream wrappers in file paths are not supported');
}
}
if ($file[0] === '*') {
// image as external stream
$file = substr($file, 1);