Security: Sanitize file name when uploading chunks with bigUpload (2)

chamilo · Sep 21, 2023 · f3d62b6 · f3d62b6 · KrSi78 · Nov 28, 2023
1 parent 46247d0
commit f3d62b6
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 6 deletions.
diff --git a/main/inc/ajax/dropbox.ajax.php b/main/inc/ajax/dropbox.ajax.php
@@ -27,9 +27,12 @@
                 }
                 if (!empty($fileList)) {
                     foreach ($fileList as $n => $file) {
-                        $tmpFile = $tempDirectory.$file['name'];
+                        $tmpFile = disable_dangerous_file(
+                            api_replace_dangerous_char($file['name'])
+                        );
+
                         file_put_contents(
-                            $tmpFile,
+                            $tempDirectory.$tmpFile,
                             fopen($file['tmp_name'], 'r'),
                             FILE_APPEND
                         );

diff --git a/main/inc/ajax/exercise.ajax.php b/main/inc/ajax/exercise.ajax.php
@@ -1180,9 +1180,12 @@ function (array $exercise) {
                 }
                 if (!empty($fileList)) {
                     foreach ($fileList as $n => $file) {
-                        $tmpFile = $tempDirectory.$file['name'];
+                        $tmpFile = disable_dangerous_file(
+                            api_replace_dangerous_char($file['name'])
+                        );
+
                         file_put_contents(
-                            $tmpFile,
+                            $tempDirectory.$tmpFile,
                             fopen($file['tmp_name'], 'r'),
                             FILE_APPEND
                         );

diff --git a/main/inc/ajax/work.ajax.php b/main/inc/ajax/work.ajax.php
@@ -76,9 +76,12 @@
                 }
                 if (!empty($fileList)) {
                     foreach ($fileList as $n => $file) {
-                        $tmpFile = $tempDirectory.$file['name'];
+                        $tmpFile = disable_dangerous_file(
+                            api_replace_dangerous_char($file['name'])
+                        );
+
                         file_put_contents(
-                            $tmpFile,
+                            $tempDirectory.$tmpFile,
                             fopen($file['tmp_name'], 'r'),
                             FILE_APPEND
                         );