| @@ -62,8 +62,12 @@ | ||
| 62 | 62 | $isAutomationAdmin = false; |
| 63 | 63 | $fromMail = ''; |
| 64 | 64 | |
| 65 | 65 | if (!empty($fromId)) { |
| 66 | + if (!$mailClass->hasUserAccess($fromId)) { | |
| 67 | + die('Access denied for this email'); | |
| 68 | + } | |
| 69 | + | |
| 66 | 70 | $fromMail = $mailClass->getOneById($fromId); |
| 67 | 71 | } |
| 68 | 72 | |
| 69 | 73 | if ($type === 'automation_admin') { |
| @@ -646,13 +650,13 @@ | ||
| 646 | 650 | 'size' => filesize(ACYM_ROOT.$filepath), |
| 647 | 651 | ]; |
| 648 | 652 | |
| 649 | 653 | //We will never allow some files to be uploaded... |
| 650 | - if (preg_match('#\.(php.?|.?htm.?|pl|py|jsp|asp|sh|cgi)#Ui', $attachment['filename'])) { | |
| 654 | + if (acym_isForbiddenFileExtension($attachment['filename'])) { | |
| 651 | 655 | acym_enqueueMessage( |
| 652 | 656 | acym_translationSprintf( |
| 653 | 657 | 'ACYM_ACCEPTED_TYPE', |
| 654 | - substr($attachment['filename'], strrpos($attachment['filename'], '.') + 1), | |
| 658 | + esc_html(substr($attachment['filename'], strrpos($attachment['filename'], '.') + 1)), | |
| 655 | 659 | $this->config->get('allowed_files') |
| 656 | 660 | ), |
| 657 | 661 | 'notice' |
| 658 | 662 | ); |
| @@ -985,9 +989,9 @@ | ||
| 985 | 989 | $newPathComplete = $newPath.'.'.$extension; |
| 986 | 990 | |
| 987 | 991 | $allowedExtensions = acym_getImageFileExtensions(true); |
| 988 | 992 | if (!in_array($extension, $allowedExtensions)) { |
| 989 | - $errorMessage = acym_translationSprintf('ACYM_ACCEPTED_TYPE', $extension, implode(', ', $allowedExtensions)); | |
| 993 | + $errorMessage = acym_translationSprintf('ACYM_ACCEPTED_TYPE', esc_html($extension), implode(', ', $allowedExtensions)); | |
| 990 | 994 | } elseif (!acym_uploadFile($file['tmp_name'], ACYM_ROOT.$newPathComplete)) { |
| 991 | 995 | $errorMessage = acym_translationSprintf('ACYM_ERROR_UPLOADING_FILE_X', $newPathComplete); |
| 992 | 996 | } elseif (strtolower($extension) === 'svg' && !acym_isSvgFileSafe(ACYM_ROOT.$newPathComplete)) { |
| 993 | 997 | acym_deleteFile(ACYM_ROOT.$newPathComplete); |
| @@ -1034,8 +1038,12 @@ | ||
| 1034 | 1038 | } |
| 1035 | 1039 | |
| 1036 | 1040 | $mailClass = new MailClass(); |
| 1037 | 1041 | $mail = $mailClass->getOneById($idMail); |
| 1042 | + | |
| 1043 | + if (empty($mail)) { | |
| 1044 | + exit; | |
| 1045 | + } | |
| 1038 | 1046 | |
| 1039 | 1047 | // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Returning content as text/css, need to output raw content. |
| 1040 | 1048 | echo $mailClass->buildCSS($mail->stylesheet); |
| 1041 | 1049 | exit; |
