wamo/gnu-social
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[CORE][GSFile] Assert that the destination folder where to store the attachment is inside the INSTALLDIR and store the filepath in the database

Browse Source
This commit is contained in:
Hugo Sales 2021-08-03 10:22:55 +00:00
parent 8139a21eb9
commit dc2b9f940e
No known key found for this signature in database
GPG Key ID: 7D0C7EAFC9D835A0
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Core/GSFile.php
View File

@ -30,6 +30,7 @@ use App\Util\Exception\DuplicateFoundException;
use App\Util\Exception\NoSuchFileException; use App\Util\Exception\NoSuchFileException;
use App\Util\Exception\NotFoundException; use App\Util\Exception\NotFoundException;
use App\Util\Exception\ServerException; use App\Util\Exception\ServerException;
use App\Util\Formatting;
use InvalidArgumentException; use InvalidArgumentException;
use SplFileInfo; use SplFileInfo;
use Symfony\Component\HttpFoundation\BinaryFileResponse; use Symfony\Component\HttpFoundation\BinaryFileResponse;
@ -69,6 +70,10 @@ class GSFile
?string $title = null, ?string $title = null,
bool $is_local = true): Attachment bool $is_local = true): Attachment
{ {
if (!Formatting::startsWith($dest_dir, INSTALLDIR)) {
throw new \InvalidArgumentException("Attempted to store an attachment to a folder outside the GNU social installation: {$dest_dir}");
}
$hash = null; $hash = null;
Event::handle('HashFile', [$file->getPathname(), &$hash]); Event::handle('HashFile', [$file->getPathname(), &$hash]);
try { try {
@ -88,7 +93,7 @@ class GSFile
'gsactor_id' => $actor_id, 'gsactor_id' => $actor_id,
'mimetype' => $mimetype, 'mimetype' => $mimetype,
'title' => $title, 'title' => $title,
'filename' => $hash, 'filename' => Formatting::removePrefix($dest_dir, INSTALLDIR . DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . $hash,
'is_local' => $is_local, 'is_local' => $is_local,
'size' => $file->getSize(), 'size' => $file->getSize(),
'width' => $width, 'width' => $width,