diff options
author | jim-p <jimp@netgate.com> | 2019-07-01 15:58:16 -0400 |
---|---|---|
committer | jim-p <jimp@netgate.com> | 2019-07-01 16:00:06 -0400 |
commit | e0bd07fdae37d92427eda1c429569fcc1cc27185 (patch) | |
tree | 4dd3c023fa997ef37ceaf33ed5556ba9c1ae3aa9 /src/usr/local/www | |
parent | 3c2cc702439f725bd04ad22cd7809bc6652258f9 (diff) | |
download | pfsense-e0bd07fdae37d92427eda1c429569fcc1cc27185.zip pfsense-e0bd07fdae37d92427eda1c429569fcc1cc27185.tar.gz |
Picture widget corrections. Fixes #9610
* Sanitize user input before using as path/filenames
* Use a more accurate method of determining image type on read
* More sanity checks before reading images.
(cherry picked from commit 2c544ac61ce98f716d50b8e5961d7dfba66804b5)
Diffstat (limited to 'src/usr/local/www')
-rw-r--r-- | src/usr/local/www/widgets/widgets/picture.widget.php | 43 |
1 files changed, 34 insertions, 9 deletions
diff --git a/src/usr/local/www/widgets/widgets/picture.widget.php b/src/usr/local/www/widgets/widgets/picture.widget.php index 8cf39bc..e0fdc78 100644 --- a/src/usr/local/www/widgets/widgets/picture.widget.php +++ b/src/usr/local/www/widgets/widgets/picture.widget.php @@ -25,18 +25,42 @@ require_once("functions.inc"); if ($_GET['getpic']=="true") { - $pic_type_s = explode(".", $user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']); - $pic_type = $pic_type_s[1]; + $wk = basename($_GET['widgetkey']); + $image_filename = "/conf/widget_image.{$wk}"; + if (empty($wk) || + !isset($user_settings['widgets'][$wk]) || + !is_array($user_settings['widgets'][$wk]) || + !file_exists($image_filename)) { + echo null; + exit; + } + + /* Do not rely on filename to determine image type. */ + $img_info =getimagesize($image_filename); + switch ($img_info[2]) { + case IMAGETYPE_GIF: + $pic_type = "gif"; + break; + case IMAGETYPE_JPEG: + $pic_type = "jpg"; + break; + case IMAGETYPE_PNG: + $pic_type = "png"; + break; + default: + echo null; + exit; + } - if ($user_settings['widgets'][$_GET['widgetkey']]['picturewidget']) { - if (file_exists("/conf/widget_image." . $_GET['widgetkey'])) { - $data = file_get_contents("/conf/widget_image." . $_GET['widgetkey']); + if ($user_settings['widgets'][$wk]['picturewidget']) { + if (file_exists($image_filename)) { + $data = file_get_contents($image_filename); } else { $data = ""; } } - header("Content-Disposition: inline; filename=\"{$user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']}\""); + header("Content-Disposition: inline; filename=\"" . basename($image_filename) . "\""); header("Content-Type: image/{$pic_type}"); header("Content-Length: " . strlen($data)); echo $data; @@ -44,6 +68,7 @@ if ($_GET['getpic']=="true") { } if ($_POST['widgetkey']) { + $wk = basename($_POST['widgetkey']); set_customwidgettitle($user_settings); if (is_uploaded_file($_FILES['pictfile']['tmp_name'])) { /* read the file contents */ @@ -66,9 +91,9 @@ if ($_POST['widgetkey']) { die("Not a gif/jpg/png"); } $picname = basename($_FILES['uploadedfile']['name']); - $user_settings['widgets'][$_POST['widgetkey']]['picturewidget'] = "/conf/widget_image"; - file_put_contents("/conf/widget_image." . $_POST['widgetkey'], $data); - $user_settings['widgets'][$_POST['widgetkey']]['picturewidget_filename'] = $_FILES['pictfile']['name']; + $user_settings['widgets'][$wk]['picturewidget'] = "/conf/widget_image"; + file_put_contents("/conf/widget_image.{$wk}", $data); + $user_settings['widgets'][$wk]['picturewidget_filename'] = $_FILES['pictfile']['name']; } } |