adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 17:23:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-j9q6-q52g-g8jw make sure SVG files have the appropriate file name extension

Browse Source
This commit is contained in:
plegall
2026-04-21 14:32:43 +02:00
parent dc839e499d
commit 7899643580
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/include/functions_upload.inc.php
+18
View File
@@ -253,6 +253,24 @@ SELECT
{
$original_extension = strtolower(get_extension($original_filename));
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$finfo_type = finfo_file($finfo, $source_filepath);
finfo_close($finfo);
if (in_array($finfo_type, ['image/svg', 'image/svg+xml']) and $original_extension != 'svg')
{
unlink($source_filepath);
$error_msg = 'File extension "'.$original_extension.'" for file "'.$original_filename.'" does not match file MIME type "'.$finfo_type.'"';
if (defined('IN_WS'))
{
global $service;
$service->sendResponse(new PwgError(415, $error_msg));
exit;
}
die($error_msg);
}
if (in_array($original_extension, $conf['file_ext']))
{
$file_path.= $original_extension;