| @@ -77,8 +77,14 @@ | ||
| 77 | 77 | |
| 78 | 78 | return $status; |
| 79 | 79 | } |
| 80 | 80 | |
| 81 | +function acym_isForbiddenFileExtension(string $filename): bool | |
| 82 | +{ | |
| 83 | + // Always blocked regardless of the "allowed files" configuration, for security reasons | |
| 84 | + return (bool)preg_match('#\.(php.?|.?htm.?|pl|py|jsp|asp|sh|cgi)#Ui', $filename); | |
| 85 | +} | |
| 86 | + | |
| 81 | 87 | function acym_importFile(array $file, string $uploadPath, bool $onlyPict): ?string |
| 82 | 88 | { |
| 83 | 89 | // Check the token... no import without token! |
| 84 | 90 | wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token'); |
| @@ -141,9 +147,9 @@ | ||
| 141 | 147 | } |
| 142 | 148 | |
| 143 | 149 | // We will never allow some files to be uploaded... |
| 144 | 150 | // This should never happen... only if there is an hack tentative so no need to translate this error message |
| 145 | - if (preg_match('#\.(php.?|.?htm.?|pl|py|jsp|asp|sh|cgi)#Ui', $file['name'])) { | |
| 151 | + if (acym_isForbiddenFileExtension($file['name'])) { | |
| 146 | 152 | acym_display( |
| 147 | 153 | 'This extension name is blocked by the system regardless your configuration for security reasons', |
| 148 | 154 | 'error' |
| 149 | 155 | ); |
| @@ -250,12 +256,12 @@ | ||
| 250 | 256 | </span> |
| 251 | 257 | <i class="acym__input__file__download cell shrink acym__color__blue cursor-pointer acymicon-download margin-right-1" |
| 252 | 258 | <?php echo $hasValue ? '' : ' style="display: none;"'; ?> |
| 253 | 259 | <?php echo !empty($downloadUrl) ? ' data-download-url="'.esc_url($downloadUrl).'"' : ''; ?> |
| 254 | - title="<?php echo esc_attr(acym_translation('ACYM_DOWNLOAD')); ?>" aria-label="<?php echo esc_attr(acym_translation('ACYM_DOWNLOAD')); ?>"></i> | |
| 260 | + title="<?php echo esc_attr(acym_translation('ACYM_DOWNLOAD')); ?>" aria-label="<?php echo esc_attr(acym_translation('ACYM_DOWNLOAD')); ?>"></i> | |
| 255 | 261 | <i class="acymicon-close acym__color__red acym__input__file__delete cursor-pointer cell shrink margin-left-1" |
| 256 | 262 | <?php echo $hasValue ? '' : ' style="display: none;"'; ?> |
| 257 | - title="<?php echo esc_attr(acym_translation('ACYM_DELETE')); ?>" aria-label="<?php echo esc_attr(acym_translation('ACYM_DELETE')); ?>"></i> | |
| 263 | + title="<?php echo esc_attr(acym_translation('ACYM_DELETE')); ?>" aria-label="<?php echo esc_attr(acym_translation('ACYM_DELETE')); ?>"></i> | |
| 258 | 264 | </div> |
| 259 | 265 | <?php |
| 260 | 266 | } |
| 261 | 267 | |
| @@ -639,10 +645,10 @@ | ||
| 639 | 645 | } |
| 640 | 646 | ?> |
| 641 | 647 | <svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="80" height="80" viewBox="0 0 1024 1024"> |
| 642 | 648 | <path class="acym__svg__loader" |
| 643 | - fill="#a6a9ab" | |
| 644 | - d="M553.074 174.168c-12.201 7.319-26.84 10.573-40.668 10.573s-27.655-3.253-40.668-10.573l-242.376-139.081-229.362 132.575v732.011l254.576 143.963v-430.26l219.602 124.442c11.388 6.507 24.401 9.76 37.415 9.76 0 0 0 0 0 0s0 0 0 0c12.201 0 25.214-3.253 36.6-9.76l221.23-124.442v430.26l254.576-144.775v-732.011l-229.362-131.762-241.563 139.081zM491.261 701.215l-217.164-122.815-61.001-34.161v430.26l-173.243-97.601v-662.063l422.94 245.629c0 0 0 0 0 0 8.947 4.881 17.895 8.135 27.655 10.573v230.178zM983.334 876.086l-173.243 98.416v-431.073l-61.001 34.161-217.164 122.815v-229.362c9.76-2.441 18.707-5.694 27.655-10.573l423.753-246.444v662.063zM539.246 425.493c-17.080 9.76-38.227 9.76-55.307 0 0 0 0 0 0 0l-422.94-245.629 168.362-97.601 222.043 127.696c18.707 10.573 39.853 16.267 61.001 16.267s42.294-5.694 61.001-16.267l222.043-127.696 168.362 97.601-424.566 245.629z"></path> | |
| 649 | + fill="#a6a9ab" | |
| 650 | + d="M553.074 174.168c-12.201 7.319-26.84 10.573-40.668 10.573s-27.655-3.253-40.668-10.573l-242.376-139.081-229.362 132.575v732.011l254.576 143.963v-430.26l219.602 124.442c11.388 6.507 24.401 9.76 37.415 9.76 0 0 0 0 0 0s0 0 0 0c12.201 0 25.214-3.253 36.6-9.76l221.23-124.442v430.26l254.576-144.775v-732.011l-229.362-131.762-241.563 139.081zM491.261 701.215l-217.164-122.815-61.001-34.161v430.26l-173.243-97.601v-662.063l422.94 245.629c0 0 0 0 0 0 8.947 4.881 17.895 8.135 27.655 10.573v230.178zM983.334 876.086l-173.243 98.416v-431.073l-61.001 34.161-217.164 122.815v-229.362c9.76-2.441 18.707-5.694 27.655-10.573l423.753-246.444v662.063zM539.246 425.493c-17.080 9.76-38.227 9.76-55.307 0 0 0 0 0 0 0l-422.94-245.629 168.362-97.601 222.043 127.696c18.707 10.573 39.853 16.267 61.001 16.267s42.294-5.694 61.001-16.267l222.043-127.696 168.362 97.601-424.566 245.629z"></path> | |
| 645 | 651 | </svg> |
| 646 | 652 | <?php |
| 647 | 653 | if ($withContainer) { |
| 648 | 654 | echo '</div>'; |
| @@ -655,8 +661,17 @@ | ||
| 655 | 661 | |
| 656 | 662 | if (strpos($filename, '..') !== false || strpos($filename, '/') !== false || strpos($filename, '\\') !== false) return false; |
| 657 | 663 | |
| 658 | 664 | return true; |
| 665 | +} | |
| 666 | + | |
| 667 | +function acym_isPathWithinDirectory(string $baseDir, string $path): bool | |
| 668 | +{ | |
| 669 | + $baseDir = rtrim($baseDir, DS).DS; | |
| 670 | + | |
| 671 | + if (strpos($path, $baseDir) !== 0) return false; | |
| 672 | + | |
| 673 | + return preg_match('#(^|[/\\\\])\.\.([/\\\\]|$)#', substr($path, strlen($baseDir))) !== 1; | |
| 659 | 674 | } |
| 660 | 675 | |
| 661 | 676 | function acym_getImageFileExtensions(bool $allowSvg = false): array |
| 662 | 677 | { |
