← All changes | app/Services/UploadService.php +21 -5 2.0.4 → 2.1.0 View file →

		@@ -44,15 +44,15 @@
44	44	public function isFileTypeSupported($file)
45	45	{
46	46	// Validate by extension against our allow-list. This is more reliable than the
47	47	// browser-provided mime, which is empty/inconsistent for types like .json and .md.
48		- $ext = strtolower(pathinfo(Arr::get($file, 'name', ''), PATHINFO_EXTENSION));
49		- if (!$ext) {
	48	+ $extension = strtolower(pathinfo(Arr::get($file, 'name', ''), PATHINFO_EXTENSION));
	49	+ if (!$extension) {
50	50	return false;
51	51	}
52	52
53		- foreach (array_keys(self::getAllowedMimeMap()) as $extPattern) {
54		- if (in_array($ext, explode('|', $extPattern), true)) {
	53	+ foreach (array_keys(self::getAllowedMimeMap()) as $extensionPattern) {
	54	+ if (in_array($extension, explode('|', $extensionPattern), true)) {
55	55	return true;
56	56	}
57	57	}
58	58
		@@ -87,9 +87,25 @@
87	87	'gz|gzip' => 'application/gzip',
88	88	];
89	89
90	90	$map = array_merge(get_allowed_mime_types(), $extraMimes);
	91	+ $map = apply_filters('fluent_boards/upload_allowed_mimes', $map);
91	92
92		- return apply_filters('fluent_boards/upload_allowed_mimes', $map);
	93	+ // Never allow executable or browser-active formats through plugin filters.
	94	+ $blockedExtensions = [
	95	+ 'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar',
	96	+ 'html', 'htm', 'shtml', 'xhtml', 'xht',
	97	+ 'js', 'mjs', 'svg', 'svgz', 'xml', 'xsl', 'xslt', 'swf', 'htaccess',
	98	+ ];
	99	+ $safeMap = [];
	100	+
	101	+ foreach ($map as $extensionPattern => $mimeType) {
	102	+ $extensions = array_diff(explode('|', strtolower($extensionPattern)), $blockedExtensions);
	103	+ if ($extensions) {
	104	+ $safeMap[implode('|', $extensions)] = $mimeType;
	105	+ }
	106	+ }
	107	+
	108	+ return $safeMap;
93	109	}
94	110
95	111	}