webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-07 23:03:00 +03:00
Code Activity

Added extension whitelist for image uploads

Browse Source 
- A continuation of the security issues addressed in v0.25.3
This commit is contained in:
Dan Brown
2019-03-21 19:43:15 +00:00
parent 37b91b6b0e
commit f5fe524e6c
5 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Http/Controllers/ImageController.php
View File

@@ -119,7 +119,7 @@ class ImageController extends Controller
{
$this->checkPermission('image-create-all');
$this->validate($request, [
'file' => 'mimes:jpeg,png,gif,bmp,webp,tiff'
'file' => 'image_extension|mimes:jpeg,png,gif,bmp,webp,tiff'
]);
if (!$this->imageRepo->isValidType($type)) {

8
app/Providers/AppServiceProvider.php
View File

@@ -8,6 +8,7 @@ use BookStack\Entities\Page;
use BookStack\Settings\Setting;
use BookStack\Settings\SettingService;
use Illuminate\Database\Eloquent\Relations\Relation;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\ServiceProvider;
use Schema;
use Validator;
@@ -21,6 +22,13 @@ class AppServiceProvider extends ServiceProvider
*/
public function boot()
{
// Custom validation methods
Validator::extend('image_extension', function ($attribute, $value, $parameters, $validator) {
$validImageExtensions = ['png', 'jpg', 'jpeg', 'bmp', 'gif', 'tiff', 'webp'];
return in_array(strtolower($value->getClientOriginalExtension()), $validImageExtensions);
});
// Custom blade view directives
Blade::directive('icon', function ($expression) {
return "<?php echo icon($expression); ?>";