Skip to content

Commit 6f36e84

Browse files
committed
[Thumbnail] Validate media query name
1 parent d8377fc commit 6f36e84

File tree

2 files changed

+9
-0
lines changed

2 files changed

+9
-0
lines changed

Diff for: bundles/AdminBundle/Controller/Admin/SettingsController.php

+5
Original file line numberDiff line numberDiff line change
@@ -1331,6 +1331,11 @@ public function thumbnailUpdateAction(Request $request)
13311331
});
13321332

13331333
foreach ($mediaData as $mediaName => $items) {
1334+
1335+
if(preg_match('/["<>]/', $mediaName)) {
1336+
throw new \Exception('Invalid media query name');
1337+
}
1338+
13341339
foreach ($items as $item) {
13351340
$type = $item['type'];
13361341
unset($item['type']);

Diff for: bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js

+4
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,10 @@ pimcore.settings.thumbnail.item = Class.create({
216216
name = '(max-width: ' + name.replace("w", "") + 'px)';
217217
}
218218

219+
if(name.match(/["<>]/)) {
220+
return;
221+
}
222+
219223
if (this.medias[name]) {
220224
return;
221225
}

0 commit comments

Comments
 (0)