composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-18 23:08:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°4360 Security hardening

Browse Source
This commit is contained in:
Pierre Goiffon
2021-11-16 09:42:12 +01:00
parent 75450ded1d
commit 8adf743cc7
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/attributedef.class.inc.php
View File

@@ -7351,6 +7351,11 @@ class AttributeImage extends AttributeBlob
{
if ($value instanceof ormDocument && !$value->IsEmpty())
{
if ($value->GetMimeType() === 'image/svg+xml') {
// N°4360 SVG can contain JavaScript...
return false;
}
return ($value->GetMainMimeType() == 'image');
}

11
core/dbobject.class.php
View File

@@ -1955,7 +1955,16 @@ abstract class DBObject implements iDisplay
}
if (!$oAtt->CheckFormat($toCheck))
{
return "Wrong format [$toCheck]";
$sErrorMessage = 'Wrong format';
if ($oAtt instanceof AttributeDBFieldVoid) {
$sErrorMessage .= " [$toCheck]";
}
if ($oAtt instanceof AttributeBlob) {
/** @var $toCheck \ormDocument */
$sErrorMessage .= ' ['.$toCheck->GetFileName().']';
}
return $sErrorMessage;
}
}
else