Soper
/
sugoi
forked from gitbot/uguu
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

no more double dots

pull/1/head
Go Johansson 2022-01-22 19:50:06 +01:00
parent c3324d98c6
commit 8fa8e4d362
3 changed files with 19 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dist.json
View File

@ -65,12 +65,5 @@
"application/x-executable", "application/x-executable",
"application/x-mach-binary", "application/x-mach-binary",
"image/svg+xml" "image/svg+xml"
],
"DOUBLE_DOTS": [
"tar.gz",
"tar.bz",
"tar.bz2",
"tar.xz",
"user.js"
] ]
} }

1
static/php/includes/Core.namespace.php
View File

@ -85,7 +85,6 @@ namespace Core {
self::$ID_CHARSET = $settings_array['ID_CHARSET']; self::$ID_CHARSET = $settings_array['ID_CHARSET'];
self::$BLOCKED_EXTENSIONS = $settings_array['BLOCKED_EXTENSIONS']; self::$BLOCKED_EXTENSIONS = $settings_array['BLOCKED_EXTENSIONS'];
self::$BLOCKED_MIME = $settings_array['BLOCKED_MIME']; self::$BLOCKED_MIME = $settings_array['BLOCKED_MIME'];
self::$DOUBLE_DOTS = $settings_array['DOUBLE_DOTS'];
} catch (Exception) { } catch (Exception) {
throw new Exception('Cant populate settings.', 500); throw new Exception('Cant populate settings.', 500);
} }

45
static/php/includes/Upload.class.php
View File

@ -106,7 +106,23 @@ class Upload
'size' => self::$FILE_SIZE 'size' => self::$FILE_SIZE
]; ];
} }
public function fileInfo()
{
if (isset($_FILES['files'])) {
self::$SHA1 = sha1_file(self::$TEMP_FILE);
$finfo = finfo_open(FILEINFO_MIME_TYPE);
self::$FILE_MIME = finfo_file($finfo, self::$TEMP_FILE);
$extension = explode('.',self::$FILE_NAME,2);
self::$FILE_EXTENSION = $extension['1'];
finfo_close($finfo);
if (Settings::$LOG_IP) {
self::$IP = $_SERVER['REMOTE_ADDR'];
} else {
self::$IP = '0';
}
}
}
/** /**
* @throws Exception * @throws Exception
*/ */
@ -124,8 +140,9 @@ class Upload
self::$NEW_NAME .= Settings::$ID_CHARSET[mt_rand(0, strlen(Settings::$ID_CHARSET))]; self::$NEW_NAME .= Settings::$ID_CHARSET[mt_rand(0, strlen(Settings::$ID_CHARSET))];
} }
if (isset(self::$FILE_EXTENSION) && self::$FILE_EXTENSION !== '') { if(isset(self::$FILE_EXTENSION)){
self::$NEW_NAME_FULL = self::$NEW_NAME . '.' . self::$FILE_EXTENSION; self::$NEW_NAME_FULL = self::$NEW_NAME;
self::$NEW_NAME_FULL .= '.'.self::$FILE_EXTENSION;
} }
if (Settings::$BLACKLIST_DB) { if (Settings::$BLACKLIST_DB) {
@ -141,30 +158,6 @@ class Upload
return self::$NEW_NAME_FULL; return self::$NEW_NAME_FULL;
} }
public function fileInfo()
{
if (isset($_FILES['files'])) {
self::$SHA1 = sha1_file(self::$TEMP_FILE);
$finfo = finfo_open(FILEINFO_MIME_TYPE);
self::$FILE_MIME = finfo_file($finfo, self::$TEMP_FILE);
finfo_close($finfo);
if (Settings::$LOG_IP) {
self::$IP = $_SERVER['REMOTE_ADDR'];
} else {
self::$IP = '0';
}
foreach (Settings::$DOUBLE_DOTS as $DDOT) {
if (stripos(strrev(self::$FILE_NAME), $DDOT) === 0) {
self::$FILE_EXTENSION = strrev($DDOT);
} else {
self::$FILE_EXTENSION = pathinfo(self::$FILE_NAME, PATHINFO_EXTENSION);
}
}
}
}
/** /**
* @throws Exception * @throws Exception
*/ */