Changeset 3268:282b26727770

Timestamp:

07/13/16 16:09:12 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Prevents downloading zipped folder outside media root folder, thanks wiswat for reporting this.

File:

• admin/media.php (modified) (2 diffs)

admin/media.php

@@ -140 +140 @@
 } catch (Exception $e) {
      $core->error->add($e->getMessage());
+}
+
+# Zip download
+if (!empty($_GET['zipdl']) && $core->auth->check('media_admin',$core->blog->id))
+{
+     try
+     {
+          if (strpos(realpath($core->media->root.'/'.$d),realpath($core->media->root)) === 0) {
+               // Media folder or one of it's sub-folder(s)
+               @set_time_limit(300);
+               $fp = fopen('php://output','wb');
+               $zip = new fileZip($fp);
+               $zip->addExclusion('#(^|/).(.*?)_(m|s|sq|t).jpg$#');
+               $zip->addDirectory($core->media->root.'/'.$d,'',true);
+
+               header('Content-Disposition: attachment;filename='.date('Y-m-d').'-'.$core->blog->id.'-'.($d ? $d : 'media').'.zip');
+               header('Content-Type: application/x-zip');
+               $zip->write();
+               unset($zip);
+               exit;
+          } else {
+               $d = null;
+               $core->media->chdir($d);
+               throw new Exception(__('Not a valid directory'));
+          }
+     }
+     catch (Exception $e)
+     {
+          $core->error->add($e->getMessage());
+     }
 }
 
@@ -193 +223 @@
           // Store new list
           $core->auth->user_prefs->interface->put('media_last_dirs',$last_dirs,'array');
-     }
-}
-
-# Zip download
-if (!empty($_GET['zipdl']) && $core->auth->check('media_admin',$core->blog->id))
-{
-     try
-     {
-          @set_time_limit(300);
-          $fp = fopen('php://output','wb');
-          $zip = new fileZip($fp);
-          $zip->addExclusion('#(^|/).(.*?)_(m|s|sq|t).jpg$#');
-          $zip->addDirectory($core->media->root.'/'.$d,'',true);
-
-          header('Content-Disposition: attachment;filename='.date('Y-m-d').'-'.$core->blog->id.'-'.($d ? $d : 'media').'.zip');
-          header('Content-Type: application/x-zip');
-          $zip->write();
-          unset($zip);
-          exit;
-     }
-     catch (Exception $e)
-     {
-          $core->error->add($e->getMessage());
      }
 }