summaryrefslogtreecommitdiff
path: root/classes/File.php
diff options
context:
space:
mode:
authorBrion Vibber <brion@pobox.com>2010-02-01 08:48:31 -0800
committerBrion Vibber <brion@pobox.com>2010-02-01 08:49:59 -0800
commit6159edcebbcb1c230113e18788a676035979a4c8 (patch)
tree83c5f5b9ad3fb1618756398db42780b8cc7b22ce /classes/File.php
parent57d8f22a3ae8aba882b7782cbc426e65cdb355f6 (diff)
Improve name validation checks on local File references
Diffstat (limited to 'classes/File.php')
-rw-r--r--classes/File.php17
1 files changed, 17 insertions, 0 deletions
diff --git a/classes/File.php b/classes/File.php
index c527c4ffe..6dd9e0c06 100644
--- a/classes/File.php
+++ b/classes/File.php
@@ -176,8 +176,22 @@ class File extends Memcached_DataObject
return "$nickname-$datestamp-$random.$ext";
}
+ /**
+ * Validation for as-saved base filenames
+ */
+ static function validFilename($filename)
+ {
+ return preg_match('^/[A-Za-z0-9._-]+$/', $filename);
+ }
+
+ /**
+ * @throws ClientException on invalid filename
+ */
static function path($filename)
{
+ if (!self::validFilename($filename)) {
+ throw new ClientException("Invalid filename");
+ }
$dir = common_config('attachments', 'dir');
if ($dir[strlen($dir)-1] != '/') {
@@ -189,6 +203,9 @@ class File extends Memcached_DataObject
static function url($filename)
{
+ if (!self::validFilename($filename)) {
+ throw new ClientException("Invalid filename");
+ }
if(common_config('site','private')) {
return common_local_url('getfile',