diff --git a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php index 44590496d3bae26a7e71b3395080b776fa272bc0..05901a11ec3287cb9c5fec88436aca099aaaeb7d 100644 --- a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php +++ b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php @@ -49,6 +49,12 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac $saveLogo = false; } + //mime type check + $mimeType = vtlib_mime_content_type($logoDetails['tmp_name']); + $mimeTypeContents = explode('/', $mimeType); + if (!$logoDetails['size'] || $mimeTypeContents[0] != 'image' || !in_array($mimeTypeContents[1], Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { + $saveLogo = false; + } // Check for php code injection $imageContents = file_get_contents($logoDetails["tmp_name"]); if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) {