Project

General

Profile

« Previous | Next » 

Revision 2c544ac6

Added by Jim Pingle about 6 years ago

Picture widget corrections. Fixes #9610

  • Sanitize user input before using as path/filenames
  • Use a more accurate method of determining image type on read
  • More sanity checks before reading images.

View differences:

src/usr/local/www/widgets/widgets/picture.widget.php
25 25

  
26 26

  
27 27
if ($_GET['getpic']=="true") {
28
	$pic_type_s = explode(".", $user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']);
29
	$pic_type = $pic_type_s[1];
28
	$wk = basename($_GET['widgetkey']);
29
	$image_filename = "/conf/widget_image.{$wk}";
30
	if (empty($wk) ||
31
	    !isset($user_settings['widgets'][$wk]) ||
32
	    !is_array($user_settings['widgets'][$wk]) ||
33
	    !file_exists($image_filename)) {
34
		echo null;
35
		exit;
36
	}
37

  
38
	/* Do not rely on filename to determine image type. */
39
	$img_info =getimagesize($image_filename);
40
	switch ($img_info[2]) {
41
		case IMAGETYPE_GIF:
42
			$pic_type = "gif";
43
			break;
44
		case IMAGETYPE_JPEG:
45
			$pic_type = "jpg";
46
			break;
47
		case IMAGETYPE_PNG:
48
			$pic_type = "png";
49
			break;
50
		default:
51
			echo null;
52
			exit;
53
	}
30 54

  
31
	if ($user_settings['widgets'][$_GET['widgetkey']]['picturewidget']) {
32
		if (file_exists("/conf/widget_image." . $_GET['widgetkey'])) {
33
			$data = file_get_contents("/conf/widget_image." . $_GET['widgetkey']);
55
	if ($user_settings['widgets'][$wk]['picturewidget']) {
56
		if (file_exists($image_filename)) {
57
			$data = file_get_contents($image_filename);
34 58
		} else {
35 59
			$data = "";
36 60
		}
37 61
	}
38 62

  
39
	header("Content-Disposition: inline; filename=\"{$user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']}\"");
63
	header("Content-Disposition: inline; filename=\"" . basename($image_filename) . "\"");
40 64
	header("Content-Type: image/{$pic_type}");
41 65
	header("Content-Length: " . strlen($data));
42 66
	echo $data;
......
44 68
}
45 69

  
46 70
if ($_POST['widgetkey']) {
71
	$wk = basename($_POST['widgetkey']);
47 72
	set_customwidgettitle($user_settings);
48 73
	if (is_uploaded_file($_FILES['pictfile']['tmp_name'])) {
49 74
		/* read the file contents */
......
66 91
				die("Not a gif/jpg/png");
67 92
			}
68 93
			$picname = basename($_FILES['uploadedfile']['name']);
69
			$user_settings['widgets'][$_POST['widgetkey']]['picturewidget'] = "/conf/widget_image";
70
			file_put_contents("/conf/widget_image." . $_POST['widgetkey'], $data);
71
			$user_settings['widgets'][$_POST['widgetkey']]['picturewidget_filename'] = $_FILES['pictfile']['name'];
94
			$user_settings['widgets'][$wk]['picturewidget'] = "/conf/widget_image";
95
			file_put_contents("/conf/widget_image.{$wk}", $data);
96
			$user_settings['widgets'][$wk]['picturewidget_filename'] = $_FILES['pictfile']['name'];
72 97
		}
73 98
	}
74 99

  

Also available in: Unified diff