File tree Expand file tree Collapse file tree 2 files changed +17
-4
lines changed Expand file tree Collapse file tree 2 files changed +17
-4
lines changed Original file line number Diff line number Diff line change @@ -632,4 +632,14 @@ private static function generateSecTokenVariable(string $prefix = ''): string
632
632
633
633
return $ prefix .'_sec_token ' ;
634
634
}
635
+ /**
636
+ * Sanitize a string, so it can be used in the exec() command without
637
+ * "jail-breaking" to execute other commands.
638
+ * @param string $param The string to filter
639
+ * @return string
640
+ */
641
+ public static function sanitizeExecParam (string $ param ): string
642
+ {
643
+ return preg_replace ('/[`;&|]/ ' , '' , $ param );
644
+ }
635
645
}
Original file line number Diff line number Diff line change @@ -29,10 +29,13 @@ function wsConvertPpt($pptData)
29
29
}
30
30
}
31
31
$ fileData = $ pptData ['file_data ' ];
32
- $ dataInfo = pathinfo ($ pptData ['file_name ' ]);
33
- $ fileName = basename ($ pptData ['file_name ' ], '. ' .$ dataInfo ['extension ' ]);
34
- $ fullFileName = $ pptData ['file_name ' ];
35
- $ size = $ pptData ['service_ppt2lp_size ' ];
32
+ // Clean filename to avoid hacks. Prevents "&" and ";" to be used in filename, notably
33
+ $ sanitizedFileName = Security::sanitizeExecParam ($ pptData ['file_name ' ]);
34
+ $ dataInfo = pathinfo ($ sanitizedFileName );
35
+ $ fileName = basename ($ sanitizedFileName , '. ' .$ dataInfo ['extension ' ]);
36
+ // Add additional cleaning of .php and .htaccess files
37
+ $ fullFileName = Security::filter_filename ($ sanitizedFileName );
38
+ $ size = Security::sanitizeExecParam ($ pptData ['service_ppt2lp_size ' ]);
36
39
$ w = '800 ' ;
37
40
$ h = '600 ' ;
38
41
if (!empty ($ size )) {
You can’t perform that action at this time.
0 commit comments