Fixed issue #13558: Authenticated remote code execution by unrestrict…

…ed file uploads
LimeSurvey · Jun 5, 2018 · 42080b5 · Shnoulle · Jun 5, 2018 · dominikvitt
1 parent 0f710b3
commit 42080b5
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 7 deletions.
diff --git a/application/controllers/admin/themes.php b/application/controllers/admin/themes.php
@@ -179,13 +179,12 @@ public function upload()
                         false
                     );
                 }
-                $checkImage = getimagesize($_FILES["file"]["tmp_name"]);
-                $debug[] = $checkImage;
-                if ($checkImage === false || !in_array($checkImage[2], [IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_GIF])) {
-                    $uploadresult = gT("This file is not a supported image - please only upload JPG,PNG or GIF type images.");
+                Yii::import('application.helpers.common_helper', true);
+                $checkImage = validateImage($_FILES["file"]["tmp_name"]);
+                if ($checkImage['check'] === false) {
                     return Yii::app()->getController()->renderPartial(
                         '/admin/super/_renderJson',
-                        array('data' => ['success' => $success, 'message' => $uploadresult, 'debug' => $debug]),
+                        array('data' => ['success' => $success, 'message' => $checkImage['uploadresult'], 'debug' => $checkImage['debug']]),
                         false,
                         false
                     );

diff --git a/application/helpers/common_helper.php b/application/helpers/common_helper.php
@@ -4916,3 +4916,27 @@ function get_absolute_path($path)
     }
     return implode(DIRECTORY_SEPARATOR, $absolutes);
 }
+
+/**
+* A function to validate images
+*
+* @param mixed $path
+* @return array
+*/
+function validateImage($path)
+{
+    $result =[];
+    $checkImage = getimagesize($path);
+    $result['debug'] = $checkImage;
+    $result['uploadresult'] = '';
+    $checkSvg = mime_content_type($path);
+
+    if (!($checkImage !== false || $checkSvg === 'image/svg+xml')) {
+        $result['uploadresult'] = gT("This file is not a supported image - please only upload JPG,PNG,GIF or SVG type images.");
+        $result['check'] = false;
+    } else {
+        $result['check'] = true;
+    }
+
+    return $result;
+}
diff --git a/application/models/TemplateConfiguration.php b/application/models/TemplateConfiguration.php
@@ -642,8 +642,9 @@ private function _filterImages($file)
 
         $filepath = App()->getAssetManager()->publish($imagePath);
 
-        $checkImage = getimagesize($imagePath);
-        if (!($checkImage === false || !in_array($checkImage[2], [IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_GIF]))) {
+        Yii::import('application.helpers.common_helper', true);
+        $checkImage = validateImage($imagePath);
+        if (!$checkImage['check'] === false) {
                 return ['filepath' => $filepath, 'filepathOptions' => $imagePath ,'filename'=>$file['name']];
         }
     }