fix: don't allow to upload arbitrary binary data

thorsten · Mar 17, 2024 · 9136883 · 9136883
1 parent c94b3de
commit 9136883
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/phpmyfaq/admin/api/attachment.php b/phpmyfaq/admin/api/attachment.php
@@ -81,7 +81,7 @@
             if (
                 is_uploaded_file($file['tmp_name']) &&
                 !($file['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
-                $file['type'] !== "text/html"
+                $file['type'] !== 'text/html' && $file['type'] !== 'application/octet-stream'
             ) {
                 $attachment = AttachmentFactory::create();
                 $attachment->setRecordId($recordId);
@@ -101,7 +101,7 @@
                 ];
             } else {
                 $response->setStatusCode(Response::HTTP_BAD_REQUEST);
-                $response->setData('The image is too large.');
+                $response->setData('The file is too large or unsupported.');
                 $response->send();
                 return;
             }

diff --git a/phpmyfaq/src/phpMyFAQ/Attachment/File.php b/phpmyfaq/src/phpMyFAQ/Attachment/File.php
@@ -103,7 +103,7 @@ public function save($filePath, $filename = null): bool
             $targetFile = $this->buildFilePath();
 
             if (null !== $this->id && $this->createSubDirs($targetFile)) {
-                // Doing this check we're sure not to unnecessary
+                // Doing this check, we're sure not to unnecessarily
                 // overwrite existing unencrypted file duplicates.
                 if (!$this->linkedRecords()) {
                     $source = new VanillaFile($filePath);