vanzhiganov/clipbucket
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

modified : secuirity fixes of file uploading has been applied

Browse source
This commit is contained in:
Fahad Abbas 2018-02-21 15:59:36 +05:00
parent 4038063c37
commit 0e2dcd269d
2 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
upload/actions/beats_uploader.php
View file

@ -46,7 +46,7 @@ switch($mode)
echo json_encode($updateResponse);
}
break;
case "uploadPhoto":
/* case "uploadPhoto":
{
$exts = $cbphoto->exts;
$max_size = 1048576; // 2MB in bytes
@ -126,7 +126,7 @@ switch($mode)
exit(0);
}
}
break;
break;*/
case 'plupload': {

14
upload/actions/photo_uploader.php
View file

@ -161,6 +161,14 @@ switch($mode)
upload_error("Invalid file extension");
exit(0);
}
#checking for if the right file is uploaded
$content_type = get_mime_type($_FILES[$form]['tmp_name']);
if ( $content_type != 'image') {
upload_error("Invalid file type");
exit();
}
$filename = $cbphoto->create_filename();
@ -178,7 +186,7 @@ switch($mode)
break;
case 'plupload': {
/* case 'plupload': {
$status_array = array();
// HTTP headers for no cache etc
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
@ -193,6 +201,7 @@ switch($mode)
echo json_encode(array("status"=>"400","err"=>"Invalid Content"));
exit();
}
$extension = getExt( $_FILES['file']['name']);
$types = strtolower(config('allowed_types'));
$supported_extensions = explode(',', $types);
@ -201,6 +210,7 @@ switch($mode)
echo json_encode(array("status"=>"504","msg"=>"Invalid extension"));
exit();
}
//pr($_REQUEST);
$targetDir = PHOTOS_DIR;
$directory = create_dated_folder( PHOTOS_DIR );
@ -325,7 +335,7 @@ switch($mode)
rename($filePath, $targetFile);
echo json_encode( array("success"=>"yes","file_name"=>$filename, "extension" => getExt( $filePath ), "file_directory" => $directory ) );
}
}*/
break;
}