Skip to content

2.3.2 – security fix, Transfer and Manual cards

Choose a tag to compare

View all tags
@EV-soft EV-soft released this 25 Oct 09:17
· 27 commits to main since this release
v2.3.2
74f5513

Security - please update

A request with csvFile=<name> made the table write a file of that name in the program folder: any logged-in account - also a read only demo account - could overwrite folder-explorer.php or fe-users.php. The export is never taken from the request now (no button used it).

Fixes

  • Deleting one file with the trash switched off could remove a file of the program - refused now.
  • A ZIP made of a folder x.php was called x.php.zip - a name upload and rename refuse (Apache may run it as PHP). Now x_php.zip.
  • ?show[]=x gave a fatal error (also before the log-in).
  • File names with invalid UTF-8 (old Latin-1 names on Linux) were shown empty and their menu did not work.

Layout

The Transfer card is below the folder content, and the manual is a card of its own at the bottom of the page.

Updating from 2.3.x: replace folder-explorer.php and _trans.sys.json.

Demo: https://ev-soft.dk/foldexpl/folder-explorer.php

Assets 2
Loading