Mirrors/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-02-20 19:56:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added XSS check for uploaded SVG files before they get stored (in Form plugin)

Browse Source
This commit is contained in:
Matias Griese 2022-03-14 18:55:56 +02:00
parent 4d4efb31e3
commit 492cc1d2f1
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
system/src/Grav/Framework/Form/Traits/FormTrait.php
View File

@ -23,6 +23,7 @@ use Grav\Common\User\Interfaces\UserInterface;
use Grav\Common\Utils;
use Grav\Framework\Compat\Serializable;
use Grav\Framework\ContentBlock\HtmlBlock;
use Grav\Framework\Form\FormFlashFile;
use Grav\Framework\Form\Interfaces\FormFlashInterface;
use Grav\Framework\Form\Interfaces\FormInterface;
use Grav\Framework\Session\SessionInterface;
@ -775,13 +776,16 @@ trait FormTrait
{
// Handle bad filenames.
$filename = $file->getClientFilename();
if ($filename && !Utils::checkFilename($filename)) {
$grav = Grav::instance();
throw new RuntimeException(
sprintf($grav['language']->translate('PLUGIN_FORM.FILEUPLOAD_UNABLE_TO_UPLOAD', null, true), $filename, 'Bad filename')
);
}
if ($file instanceof FormFlashFile) {
$file->checkXss();
}
}
/**