From 11464d43c617db7b66a277d40c0a5138cc42dcbd Mon Sep 17 00:00:00 2001
From: prasad <prasad@vtiger.com>
Date: Thu, 30 Jun 2016 14:14:33 +0530
Subject: [PATCH] Routing image validation in CompanyDetailsSave action to
common function.
---
.../Vtiger/actions/CompanyDetailsSave.php | 21 +++----------------
vtlib/Vtiger/Functions.php | 2 +-
2 files changed, 4 insertions(+), 19 deletions(-)
diff --git a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php
index 676e22bc2..afaa28be0 100644
--- a/modules/Settings/Vtiger/actions/CompanyDetailsSave.php
+++ b/modules/Settings/Vtiger/actions/CompanyDetailsSave.php
@@ -19,25 +19,10 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac
if ($request->get('organizationname')) {
$saveLogo = $status = true;
if(!empty($_FILES['logo']['name'])) {
- $logoDetails = $_FILES['logo'];
- $fileType = explode('/', $logoDetails['type']);
- $fileType = $fileType[1];
+ $logoDetails = $_FILES['logo'];
+ $saveLogo = Vtiger_Functions::validateImage($logoDetails);
+ if (is_string($saveLogo)) $saveLogo = ($saveLogo == 'false')? false : true;
- if (!$logoDetails['size'] || !in_array($fileType, Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) {
- $saveLogo = false;
- }
-
- //mime type check
- $mimeType = vtlib_mime_content_type($logoDetails['tmp_name']);
- $mimeTypeContents = explode('/', $mimeType);
- if (!$logoDetails['size'] || $mimeTypeContents[0] != 'image' || !in_array($mimeTypeContents[1], Settings_Vtiger_CompanyDetails_Model::$logoSupportedFormats)) {
- $saveLogo = false;
- }
- // Check for php code injection
- $imageContents = file_get_contents($_FILES["logo"]["tmp_name"]);
- if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) {
- $saveLogo = false;
- }
if ($saveLogo) {
$moduleModel->saveLogo();
}
diff --git a/vtlib/Vtiger/Functions.php b/vtlib/Vtiger/Functions.php
index 2c41085a7..e5534cfe2 100644
--- a/vtlib/Vtiger/Functions.php
+++ b/vtlib/Vtiger/Functions.php
@@ -606,7 +606,7 @@ class Vtiger_Functions {
}
//mime type check
- $mimeType = mime_content_type($file_details['tmp_name']);
+ $mimeType = self::mime_content_type($file_details['tmp_name']);
$mimeTypeContents = explode('/', $mimeType);
if (!$file_details['size'] || strtolower($mimeTypeContents[0]) !== 'image' || !in_array($mimeTypeContents[1], $mimeTypesList)) {
$saveimage = 'false';
--
GitLab