composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-23 10:38:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°4975 Security hardening

Browse Source
This commit is contained in:
Stephen Abello
2022-08-08 13:14:45 +02:00
parent 8e840d4529
commit 0599341515
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
sources/Controller/PreferencesController.php
View File

@@ -7,6 +7,7 @@
namespace Combodo\iTop\Controller;
use appUserPreferences;
use CoreUnexpectedValue;
use Exception;
use MetaModel;
use ormDocument;
@@ -38,9 +39,14 @@ class PreferencesController
appUserPreferences::SetPref('user_picture_placeholder', $sImageFilename);
$sUserPicturesFolder = 'images/user-pictures/';
$sImageAbsPath = APPROOT.$sUserPicturesFolder.$sImageFilename;
$sImageAbsPath = utils::RealPath(APPROOT.$sUserPicturesFolder.$sImageFilename, APPROOT.$sUserPicturesFolder);
$sImageAbsUrl = utils::GetAbsoluteUrlAppRoot().$sUserPicturesFolder.$sImageFilename;
// Check if we're still in the right folder
if($sImageAbsPath === false){
throw new CoreUnexpectedValue('Error while updating user image, invalid image path "'.$sUserPicturesFolder.$sImageFilename.'"');
}
// Check file can be read
$sImageData = file_get_contents($sImageAbsPath);
if (false === $sImageData) {