Changeset 1143 for trunk/plugins/ImageManager/Classes/ImageManager.php

Timestamp:

12/20/08 23:04:08 (3 years ago)

Author:

gogo

Message:

Security patch - see ticket:1363

Files:

• trunk/plugins/ImageManager/Classes/ImageManager.php (modified) (1 diff)

trunk/plugins/ImageManager/Classes/ImageManager.php

@@ -456 +456 @@
                                 Return false;
                         }
+                }
+    
+    $valid_extensions = $this->config['allowed_image_extensions'];
+    $afruext = strtolower(substr(strrchr($file['name'], "."), 1));
+    if(!in_array($afruext, $valid_extensions))
+                {
+                        Files::delFile($file['tmp_name']);
+                        Return 'Cannot upload $extension='.$afruext.'$ Files. Permission denied.';
                 }