diff --git a/vtlib/Vtiger/Functions.php b/vtlib/Vtiger/Functions.php index 67d11f7d647295710420e2b516c4fe8fb9b981e6..c95cc15b8272ce32c85f118afa9fc51fd071f45b 100644 --- a/vtlib/Vtiger/Functions.php +++ b/vtlib/Vtiger/Functions.php @@ -575,6 +575,21 @@ class Vtiger_Functions { return $filepath; } + static function validateImageMetadata($data) { + if (is_array($data)) { + foreach ($data as $key => $value) { + $ok = self::validateImageMetadata($value); + if (!$ok) return false; + } + } else { + if (stripos($data, "<?php")!== false || + (stripos($data, "<?") !== false && preg_match("/\)[\s]*;/", $data))) { + return false; + } + } + return true; + } + static function validateImage($file_details) { global $app_strings; $allowedImageFormats = array('jpeg', 'png', 'jpg', 'pjpeg', 'x-png', 'gif', 'bmp'); @@ -598,10 +613,20 @@ class Vtiger_Functions { $saveimage = 'false'; } + //metadata check + if ($saveimage == 'true') { + $exifdata = exif_read_data($file_details['tmp_name']); + if ($exifdata && !self::validateImageMetadata($exifdata)) { + $saveimage = 'false'; + } + } + // Check for php code injection - $imageContents = file_get_contents($file_details['tmp_name']); - if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) { - $saveimage = 'false'; + if ($saveimage == 'true') { + $imageContents = file_get_contents($file_details['tmp_name']); + if (preg_match('/(<\?php?(.*?))/i', $imageContents) == 1) { + $saveimage = 'false'; + } } return $saveimage; } @@ -964,11 +989,11 @@ class Vtiger_Functions { * @param $claimedMime Array of bad file extenstions */ static function verifyClaimedMIME($targetFile,$claimedMime) { - $fileMimeContentType= self::mime_content_type($targetFile); - if (in_array(strtolower($fileMimeContentType), $claimedMime)) { - return false; - } - return true; + $fileMimeContentType= self::mime_content_type($targetFile); + if (in_array(strtolower($fileMimeContentType), $claimedMime)) { + return false; + } + return true; } /*