Changeset 3850:d4841d6d65d6

Timestamp:

09/02/18 09:21:11 (7 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.14

Message:

Security: Authenticated cross-site scripting (XSS) was possible due to the .ahtml (or .bhtml, .chtml, …) file extension being allowed in the media manager.
Thank's Josiah Pierce for reporting this

Location:

inc

Files:

• core/class.dc.core.php (modified) (1 diff)
• dbschema/upgrade.php (modified) (1 diff)

inc/core/class.dc.core.php

@@ -1379 +1379 @@
                 array('lang', 'string', 'en',
                     'Default blog language'),
-                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|s?html?|js|htaccess)[0-9]*$/i',
+                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|.?html?|js|htaccess)[0-9]*$/i',
                     'File name exclusion pattern in media manager. (PCRE value)'),
                 array('media_img_m_size', 'integer', 448,

inc/dbschema/upgrade.php

@@ -688 +688 @@
         }
 
+        if (version_compare($version, '2.14.2', '<')) {
+            # Update flie exclusion upload regex
+            $strReq = 'UPDATE ' . $core->prefix . 'setting ' .
+                " SET setting_value = '/\\.(phps?|pht(ml)?|phl|.?html?|js|htaccess)[0-9]*\$/i' " .
+                " WHERE setting_id = 'media_exclusion' " .
+                " AND setting_ns = 'system' " .
+                " AND (setting_value = '/\\.php[0-9]*\$/i' " .
+                "   OR setting_value = '/\\.php\$/i') " .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl)[0-9]*\$/i' " .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl|s?html?|js)[0-9]*\$/i'" .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl|s?html?|js|htaccess)[0-9]*\$/i'";
+            $core->con->execute($strReq);
+        }
+
         $core->setVersion('core', DC_VERSION);
         $core->blogDefaults();