Skip to content

Commit

Permalink
Merge pull request from GHSA-5vpv-xmcj-9q85
Browse files Browse the repository at this point in the history
Co-authored-by: Fabrizio Balliano <fabrizio.balliano@gmail.com>
  • Loading branch information
colinmollenhour and fballiano committed Jan 26, 2023
1 parent 87115b7 commit d31571c
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,11 @@ public function deleteDirectory($path)
$io->getFilteredPath($path)
));
}
if (strpos($pathCmp, chr(0)) !== false
|| preg_match('#(^|[\\\\/])\.\.($|[\\\\/])#', $pathCmp)
) {
throw new Exception('Detected malicious path or filename input.');
}
if (Mage::helper('core/file_storage_database')->checkDbUsage()) {
Mage::getModel('core/file_storage_directory_database')->deleteDirectory($path);
Expand Down

0 comments on commit d31571c

Please sign in to comment.