Changeset 3850:d4841d6d65d6 for inc/core

Timestamp:

09/02/18 09:21:11 (7 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.14

Message:

Security: Authenticated cross-site scripting (XSS) was possible due to the .ahtml (or .bhtml, .chtml, …) file extension being allowed in the media manager.
Thank's Josiah Pierce for reporting this

File:

• inc/core/class.dc.core.php (modified) (1 diff)

inc/core/class.dc.core.php

@@ -1379 +1379 @@
                 array('lang', 'string', 'en',
                     'Default blog language'),
-                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|s?html?|js|htaccess)[0-9]*$/i',
+                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|.?html?|js|htaccess)[0-9]*$/i',
                     'File name exclusion pattern in media manager. (PCRE value)'),
                 array('media_img_m_size', 'integer', 448,