Project

General

Profile

« Previous | Next » 

Revision 1400

Added by FrankH almost 14 years ago

  1. Security fix in account
  2. Security fix in admin/media, thanks to hal 9000

View differences:

upload.php
1 1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         admintools
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
2 18

  
3
// $Id$
4

  
5
/*
6

  
7
 Website Baker Project <http://www.websitebaker.org/>
8
 Copyright (C) 2004-2009, Ryan Djurovich
9

  
10
 Website Baker is free software; you can redistribute it and/or modify
11
 it under the terms of the GNU General Public License as published by
12
 the Free Software Foundation; either version 2 of the License, or
13
 (at your option) any later version.
14

  
15
 Website Baker is distributed in the hope that it will be useful,
16
 but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 GNU General Public License for more details.
19

  
20
 You should have received a copy of the GNU General Public License
21
 along with Website Baker; if not, write to the Free Software
22
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23

  
24
*/
25

  
26 19
// Target location
27 20
if(!isset($_POST['target']) OR $_POST['target'] == '') {
28 21
	header("Location: index.php");
......
40 33
require_once(WB_PATH.'/include/pclzip/pclzip.lib.php');	// Required to unzip file.
41 34
$admin = new admin('Media', 'media_upload');
42 35

  
36
if (!$admin->checkFTAN())
37
{
38
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL);
39
	exit();
40
}
41

  
43 42
// Include the WB functions file
44 43
require_once(WB_PATH.'/framework/functions.php');
45 44

  
46 45
// Check to see if target contains ../
47
if(strstr($target, '../')) {
46
if (!check_media_path($target, false)) {
48 47
	$admin->print_error($MESSAGE['MEDIA']['TARGET_DOT_DOT_SLASH']);
49 48
}
50 49

  

Also available in: Unified diff