search

codemonauts / craft-instagram-feed

Craft CMS plugin to receive Instragram feed data as variable in templates
MIT License
27 stars 7 forks source link

user input validation in ImageController.php #59

Closed kmille closed 2 years ago

kmille commented 2 years ago

Hey, in src/controllers/ImageController.php, you read from a file with unsanitized user input. Even if it's not super exploitable as you append static strings I would prefere some user input validation. You can copy/paste from the docs: https://docs.craftcms.com/api/v3/craft-web-response.html#method-sendfile I hope we left the time where you can send null bytes to php with %00.

kringkaste commented 2 years ago

Hey, we just released version 2.0 with changed input validation. Thanks for the hint!