search

CuteNews / cutenews-2.0

Cutenews 2.0 Repositary
Other
89 stars 35 forks source link

Harden security in dashboard.php #17

Open Arek75 opened 4 years ago

Arek75 commented 4 years ago

  1. Switch from using pgrep to compare against getimagesize()['mime'] to directly comparing IMAGETYPEs against getimagesize()[2].

  2. Replace user-supplied filename with a random string, and supply an extension based on the image type provided by getimagesize().

WARNING: THESE FIXES DO NOT FIX THE UNDERLYING PROBLEM. THIS CAN ONLY BE FIXED BY FORBIDDING SCRIPT EXECUTION IN THE UPLOADS DIRECTORY!!!!

Note: Only the second fix is likely to improve security. The first one should be a speed improvement (greps are relatively expensive). I also added a missing check to make sure getimagesize() didn't return FALSE.

Again, this does NOT fully fix the issue, it only mitigates it. A full fix is only possible (as far as I can tell) by either disabling user avatars or making sure no scripts can be run in the uploads folder.

notHiks commented 1 year ago

thanks for this. i had to do some updates for php 7.4. it needed some more brakets