Knah-Tsaeb/Minigalnano
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Allow to use « .. » in directory name.

Browse source 
Some people names their directories like this :
(2014-09-01..08)+Super+Party which is a perfectly valid directory name.

But the directory traversal protection was a bit protective and
prevented this.

Now it checks if the requested directory is in the gallery directory by
comparing their real path.

Fixes sebsauvage/MinigalNano/#89
This commit is contained in:
Nicolas DIDIER 2015-07-24 13:51:43 +02:00
parent 6a670e1465
commit 950a741cbd
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
index.php
View file

@ -146,16 +146,15 @@ if (!empty($_GET['dir'])) {
$requestedDir = $_GET['dir']; $requestedDir = $_GET['dir'];
} }
$photoRoot = GALLERY_ROOT . 'photos/';
$thumbdir = rtrim('photos/' . $requestedDir, '/'); $thumbdir = rtrim('photos/' . $requestedDir, '/');
//$thumbdir = str_replace('/..', '', $thumbdir); // Prevent directory traversal attacks.
if (strstr($thumbdir, '..') !== false) {
$requestedDir = '';
$thumbdir = rtrim('photos/', '/');
}
$currentdir = GALLERY_ROOT . $thumbdir; $currentdir = GALLERY_ROOT . $thumbdir;
$thumbdirIsInPhotoRoot = strpos(realpath($thumbdir), realpath($photoRoot));
if ($thumbdirIsInPhotoRoot === false) {
die("ERROR: Could not open " . htmlspecialchars(stripslashes($currentdir)) . " for reading!");
}
//----------------------- //-----------------------
// READ FILES AND FOLDERS // READ FILES AND FOLDERS
//----------------------- //-----------------------