eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

[CORE][GSFile] Assert that the destination folder where to store the attachment is inside the INSTALLDIR and store the filepath in the database

Browse Source
This commit is contained in:
Hugo Sales 2021-08-03 10:22:55 +00:00
parent af951685ed
commit d1e92a80e5
Signed by untrusted user: someonewithpc
GPG Key ID: 7D0C7EAFC9D835A0
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Core/GSFile.php
View File

@ -30,6 +30,7 @@ use App\Util\Exception\DuplicateFoundException;
use App\Util\Exception\NoSuchFileException;
use App\Util\Exception\NotFoundException;
use App\Util\Exception\ServerException;
use App\Util\Formatting;
use InvalidArgumentException;
use SplFileInfo;
use Symfony\Component\HttpFoundation\BinaryFileResponse;
@ -69,6 +70,10 @@ class GSFile
?string $title = null,
bool $is_local = true): Attachment
{
if (!Formatting::startsWith($dest_dir, INSTALLDIR)) {
throw new \InvalidArgumentException("Attempted to store an attachment to a folder outside the GNU social installation: {$dest_dir}");
}
$hash = null;
Event::handle('HashFile', [$file->getPathname(), &$hash]);
try {
@ -88,7 +93,7 @@ class GSFile
'gsactor_id' => $actor_id,
'mimetype' => $mimetype,
'title' => $title,
'filename' => $hash,
'filename' => Formatting::removePrefix($dest_dir, INSTALLDIR . DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $hash,
'is_local' => $is_local,
'size' => $file->getSize(),
'width' => $width,