summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--actions/getfile.php2
-rw-r--r--classes/File.php17
-rwxr-xr-xscripts/setup_status_network.sh6
3 files changed, 24 insertions, 1 deletions
diff --git a/actions/getfile.php b/actions/getfile.php
index cd327e410..9cbe8e1d9 100644
--- a/actions/getfile.php
+++ b/actions/getfile.php
@@ -71,7 +71,7 @@ class GetfileAction extends Action
$filename = $this->trimmed('filename');
$path = null;
- if ($filename) {
+ if ($filename && File::validFilename($filename)) {
$path = File::path($filename);
}
diff --git a/classes/File.php b/classes/File.php
index c527c4ffe..ee418a802 100644
--- a/classes/File.php
+++ b/classes/File.php
@@ -176,8 +176,22 @@ class File extends Memcached_DataObject
return "$nickname-$datestamp-$random.$ext";
}
+ /**
+ * Validation for as-saved base filenames
+ */
+ static function validFilename($filename)
+ {
+ return preg_match('/^[A-Za-z0-9._-]+$/', $filename);
+ }
+
+ /**
+ * @throws ClientException on invalid filename
+ */
static function path($filename)
{
+ if (!self::validFilename($filename)) {
+ throw new ClientException("Invalid filename");
+ }
$dir = common_config('attachments', 'dir');
if ($dir[strlen($dir)-1] != '/') {
@@ -189,6 +203,9 @@ class File extends Memcached_DataObject
static function url($filename)
{
+ if (!self::validFilename($filename)) {
+ throw new ClientException("Invalid filename");
+ }
if(common_config('site','private')) {
return common_local_url('getfile',
diff --git a/scripts/setup_status_network.sh b/scripts/setup_status_network.sh
index 4ad808011..bacf3c3e7 100755
--- a/scripts/setup_status_network.sh
+++ b/scripts/setup_status_network.sh
@@ -13,6 +13,11 @@ export sitename="$2"
export tags="$3"
export email="$4"
export fullname="$5"
+export sitetype="$6"
+
+if [ "$sitetype" == '' ]; then
+ sitetype='single-user'
+fi
# Fixme: if this is changed later we need to update profile URLs
# for the created user.
@@ -71,6 +76,7 @@ then
sed "s/\$nickname/$nickname/" | \
sed "s/\$sitename/$sitename/" | \
sed "s/\$userpass/$userpass/" | \
+ sed "s/\$sitetype/$sitetype/" | \
php $PHPBASE/scripts/sendemail.php \
-s"$server" \
-n"$nickname" \