Mirrors/grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-02-20 19:56:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Avoid Arbitrary File Deletion abuse via Object Injection

Browse Source
This commit is contained in:
mcdruid 2024-12-03 17:53:41 +00:00
parent a1e583f657
commit dd75c9ddab
No known key found for this signature in database
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
system/src/Grav/Framework/Cache/Adapter/FileCache.php
View File

@ -201,7 +201,7 @@ class FileCache extends AbstractCache
try {
if ($this->tmp === null) {
$this->tmp = $this->directory . uniqid('', true);
$this->tmp = $this->directory . uniqid(__CLASS__, true);
}
file_put_contents($this->tmp, $data);
@ -259,7 +259,7 @@ class FileCache extends AbstractCache
#[\ReturnTypeWillChange]
public function __destruct()
{
if ($this->tmp !== null && file_exists($this->tmp)) {
if ($this->tmp !== null && (strpos(basename($this->tmp), __CLASS__) === 0) && file_exists($this->tmp)) {
unlink($this->tmp);
}
}