diff options
| -rw-r--r-- | actions/getfile.php | 2 | ||||
| -rw-r--r-- | classes/File.php | 17 | ||||
| -rwxr-xr-x | scripts/setup_status_network.sh | 6 |
3 files changed, 24 insertions, 1 deletions
diff --git a/actions/getfile.php b/actions/getfile.php index cd327e410..9cbe8e1d9 100644 --- a/actions/getfile.php +++ b/actions/getfile.php @@ -71,7 +71,7 @@ class GetfileAction extends Action $filename = $this->trimmed('filename'); $path = null; - if ($filename) { + if ($filename && File::validFilename($filename)) { $path = File::path($filename); } diff --git a/classes/File.php b/classes/File.php index c527c4ffe..ee418a802 100644 --- a/classes/File.php +++ b/classes/File.php @@ -176,8 +176,22 @@ class File extends Memcached_DataObject return "$nickname-$datestamp-$random.$ext"; } + /** + * Validation for as-saved base filenames + */ + static function validFilename($filename) + { + return preg_match('/^[A-Za-z0-9._-]+$/', $filename); + } + + /** + * @throws ClientException on invalid filename + */ static function path($filename) { + if (!self::validFilename($filename)) { + throw new ClientException("Invalid filename"); + } $dir = common_config('attachments', 'dir'); if ($dir[strlen($dir)-1] != '/') { @@ -189,6 +203,9 @@ class File extends Memcached_DataObject static function url($filename) { + if (!self::validFilename($filename)) { + throw new ClientException("Invalid filename"); + } if(common_config('site','private')) { return common_local_url('getfile', diff --git a/scripts/setup_status_network.sh b/scripts/setup_status_network.sh index 4ad808011..bacf3c3e7 100755 --- a/scripts/setup_status_network.sh +++ b/scripts/setup_status_network.sh @@ -13,6 +13,11 @@ export sitename="$2" export tags="$3" export email="$4" export fullname="$5" +export sitetype="$6" + +if [ "$sitetype" == '' ]; then + sitetype='single-user' +fi # Fixme: if this is changed later we need to update profile URLs # for the created user. @@ -71,6 +76,7 @@ then sed "s/\$nickname/$nickname/" | \ sed "s/\$sitename/$sitename/" | \ sed "s/\$userpass/$userpass/" | \ + sed "s/\$sitetype/$sitetype/" | \ php $PHPBASE/scripts/sendemail.php \ -s"$server" \ -n"$nickname" \ |