Mirrors/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-02-20 19:56:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added a new sanitize_svg security config option [default: true]

Browse Source
This commit is contained in:
Andy Miller 2019-09-03 12:07:47 -06:00
parent 45b1b0a2ef
commit ab75201f11
No known key found for this signature in database
GPG Key ID: E82B8D0EAB94EFB9
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
system/blueprints/config/security.yaml
View File

@ -105,3 +105,15 @@ form:
validate:
type: commalist
sanitize_svg:
type: toggle
label: PLUGIN_ADMIN.SANITIZE_SVG
help: PLUGIN_ADMIN.SANITIZE_SVG_HELP
highlight: 1
options:
1: PLUGIN_ADMIN.YES
0: PLUGIN_ADMIN.NO
default: true
validate:
type: bool

1
system/config/security.yaml
View File

@ -36,3 +36,4 @@ uploads_dangerous_extensions:
- htm
- js
- exe
sanitize_svg: true

10
system/src/Grav/Common/Security.php
View File

@ -22,10 +22,12 @@ class Security
*/
public static function sanitizeSVG($file)
{
$sanitizer = new Sanitizer();
$original_svg = file_get_contents($file);
$clean_svg = $sanitizer->sanitize($original_svg);
file_put_contents($file, $clean_svg);
if (Grav::instance()['config']->get('security.sanitize_svg')) {
$sanitizer = new Sanitizer();
$original_svg = file_get_contents($file);
$clean_svg = $sanitizer->sanitize($original_svg);
file_put_contents($file, $clean_svg);
}
}
/**