Project

General

Profile

« Previous | Next » 

Revision 1400

Added by FrankH almost 14 years ago

  1. Security fix in account
  2. Security fix in admin/media, thanks to hal 9000

View differences:

thumb.php
1 1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         admintools
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
2 18

  
3
// $Id$
4

  
5
/*
6

  
7
 Website Baker Project <http://www.websitebaker.org/>
8
 Copyright (C) 2004-2009, Ryan Djurovich
9

  
10
 Website Baker is free software; you can redistribute it and/or modify
11
 it under the terms of the GNU General Public License as published by
12
 the Free Software Foundation; either version 2 of the License, or
13
 (at your option) any later version.
14

  
15
 Website Baker is distributed in the hope that it will be useful,
16
 but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 GNU General Public License for more details.
19

  
20
 You should have received a copy of the GNU General Public License
21
 along with Website Baker; if not, write to the Free Software
22
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23

  
24
*/
25

  
26 19
require('../../config.php');
27 20
include_once('resize_img.php');
21
require_once(WB_PATH.'/framework/functions.php');
22

  
28 23
if (isset($_GET['img']) && isset($_GET['t'])) {
29 24
	$image = addslashes($_GET['img']);
25

  
26
	// Check to see if it contains ..
27
	if (!check_media_path($image)) {
28
		$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH'], WB_URL, false);
29
	}
30

  
30 31
	$type = addslashes($_GET['t']);
31 32
	$media = WB_PATH.MEDIA_DIRECTORY;
32 33
	$img=new RESIZEIMAGE($media.$image);

Also available in: Unified diff