composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-09-29 21:09:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°4360 Security hardening

Browse Source
This commit is contained in:
Pierre Goiffon
2021-11-23 16:58:47 +01:00
parent 3e8dd2f4a5
commit e15d4bfab6
12 changed files with 819 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
core/attributedef.class.inc.php
View File

@@ -7337,6 +7337,13 @@ class AttributeImage extends AttributeBlob
{
$oDoc = parent::MakeRealValue($proposedValue, $oHostObj);
if (($oDoc instanceof ormDocument)
&& (false === $oDoc->IsEmpty())
&& ($oDoc->GetMimeType() === 'image/svg+xml')) {
$sCleanSvg = HTMLSanitizer::Sanitize($oDoc->GetData(), 'svg_sanitizer');
$oDoc = new ormDocument($sCleanSvg, $oDoc->GetMimeType(), $oDoc->GetFileName());
}
// The validation of the MIME Type is done by CheckFormat below
return $oDoc;
}