diff --git a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php index 6c644da599ccb9c32ae0460ff4322094b50e6fd4..c86e80d8b645d71d09e12a2fabb5a60b5c387144 100644 --- a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php +++ b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php @@ -34,29 +34,14 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac $saveLogo = $status = true; $logoName = false; if(!empty($_FILES['logo']['name'])) { - $logoDetails = $_FILES['logo']; - $fileType = explode('/', $logoDetails['type']); - $fileType = $fileType[1]; - - if (!$logoDetails['size'] || !in_array($fileType, Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { - $saveLogo = false; - } - - //mime type check - $mimeType = mime_content_type($logoDetails['tmp_name']); - $mimeTypeContents = explode('/', $mimeType); - if (!$logoDetails['size'] || $mimeTypeContents[0] != 'image' || !in_array($mimeTypeContents[1], Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { - $saveLogo = false; - } - - // Check for php code injection - $imageContents = file_get_contents($logoDetails["tmp_name"]); - if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) { - $saveLogo = false; - } - if ($saveLogo) { - $logoName = ltrim(basename(' '.Vtiger_Util_Helper::sanitizeUploadFileName($logoDetails['name'], vglobal('upload_badext')))); + $logoDetails = $_FILES['logo']; + $saveLogo = Vtiger_Functions::validateImage($logoDetails); + global $upload_badext;// from config.inc.php + $binFileName = sanitizeUploadFileName($logoDetails['name'], $upload_badext); + if ($saveLogo && pathinfo($binFileName, PATHINFO_EXTENSION) != 'txt') { $moduleModel->saveLogo($logoName); + } else { + $saveLogo = false; } }else{ $saveLogo = true; @@ -93,4 +78,4 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac public function validateRequest(Vtiger_Request $request) { $request->validateWriteAccess(); } -} \ No newline at end of file +} diff --git a/modules/Settings/Vtiger/actions/UpdateCompanyLogo.php b/modules/Settings/Vtiger/actions/UpdateCompanyLogo.php index 3ef113e43275d28587d304bc5c9365ab116a3c02..529ea9ede02f51853d3d5c43182c93affd9f97f1 100644 --- a/modules/Settings/Vtiger/actions/UpdateCompanyLogo.php +++ b/modules/Settings/Vtiger/actions/UpdateCompanyLogo.php @@ -16,32 +16,21 @@ class Settings_Vtiger_UpdateCompanyLogo_Action extends Settings_Vtiger_Basic_Act $moduleModel = Settings_Vtiger_CompanyDetails_Model::getInstance(); $saveLogo = $securityError = false; - $logoDetails = $_FILES['logo']; - $fileType = explode('/', $logoDetails['type']); - $fileType = $fileType[1]; - - $logoContent = file_get_contents($logoDetails['tmp_name']); - if (preg_match('(<\?php?(.*?))', $logoContent) != 0) { - $securityError = true; - } - - if (!$securityError) { - if ($logoDetails['size'] && in_array($fileType, Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) { - $saveLogo = true; - } - - if ($saveLogo) { - $logoName = ltrim(basename(' '.Vtiger_Util_Helper::sanitizeUploadFileName($logoDetails['name'], vglobal('upload_badext')))); - $moduleModel->saveLogo(); - $moduleModel->set('logoname', $logoName); - $moduleModel->save(); - } - } + $logoDetails = $_FILES['logo']; + $saveLogo = Vtiger_Functions::validateImage($logoDetails); + if ($saveLogo) { + $sanitizedFileName = ltrim(basename(' '.Vtiger_Util_Helper::sanitizeUploadFileName($logoDetails['name'], vglobal('upload_badext')))); + if(pathinfo($sanitizedFileName, PATHINFO_EXTENSION) != 'txt'){ + $moduleModel->saveLogo($sanitizedFileName); + $moduleModel->set('logoname', $sanitizedFileName); + $moduleModel->save(); + }else { + $saveLogo = false; + } + } $reloadUrl = $moduleModel->getIndexViewUrl(); - if ($securityError) { - $reloadUrl .= '&error=LBL_IMAGE_CORRUPTED'; - } else if (!$saveLogo) { + if (!$saveLogo) { $reloadUrl .= '&error=LBL_INVALID_IMAGE'; } header('Location: ' . $reloadUrl); diff --git a/test/logo/.htaccess b/test/logo/.htaccess new file mode 100644 index 0000000000000000000000000000000000000000..d8323be45eaeb183d88279cade8bc4231d0a6d3f --- /dev/null +++ b/test/logo/.htaccess @@ -0,0 +1,9 @@ +RewriteEngine on +<FilesMatch ".*"> + Order deny,allow + Deny from all +</FilesMatch> + +<FilesMatch "\.(gif|jpe?g|png|bmp|PNG|GIF|BMP|jpg|JPG|ico)$"> + allow from all +</FilesMatch>