Try to catch more "evil" opportunities.

GUYS: We need some volunteers to check if uploads still work as expected and our latest changes don't break stuff. And of course that it's no longer exploitable.

diff --git a/include/admin/images.inc.php b/include/admin/images.inc.php
index f7817068a2d7e38dad5914b8bbfa83d58fb09b52..3575124dc5695498386801ad501fc6307d4781c2 100644 (file)
--- a/include/admin/images.inc.php
+++ b/include/admin/images.inc.php
@@ -54,12 +54,17 @@ switch ($serendipity['GET']['adminAction']) {
 
     case 'rename':
         $file = serendipity_fetchImageFromDatabase($serendipity['GET']['fid']);
-        $serendipity['GET']['newname'] = serendipity_uploadSecure($serendipity['GET']['newname']);
+        $serendipity['GET']['newname'] = serendipity_uploadSecure($serendipity['GET']['newname'], true);
 
         if ($serendipity['serendipityUserlevel'] < USERLEVEL_CHIEF && $file['authorid'] != '0' && $file['authorid'] != $serendipity['authorid']) {
             return;
         }
 
+        if ($serendipity['serendipityUserlevel'] < USERLEVEL_ADMIN && !serendipity_isSafeFile($serendipity['GET']['newname'])) {
+            printf(ERROR_FILE_FORBIDDEN, $serendipity['GET']['newname']);
+            return;
+        }
+
         if ($file['hotlink']) {
             serendipity_updateImageInDatabase(array('name' => $serendipity['GET']['newname']), $serendipity['GET']['fid']);
         } else {
@@ -118,13 +123,13 @@ switch ($serendipity['GET']['adminAction']) {
             $tfile   = serendipityNormalizeFilename(basename($serendipity['POST']['imageurl']));
         }
 
-        if ($serendipity['serendipityUserlevel'] < USERLEVEL_ADMIN && preg_match('@\.(php[34]?|[ps]html?)$@i', $tfile)) {
+        if ($serendipity['serendipityUserlevel'] < USERLEVEL_ADMIN && !serendipity_isSafeFile($tfile)) {
             printf(ERROR_FILE_FORBIDDEN, $tfile);
             break;
         }
 
         $tfile = serendipityNormalizeFilename(serendipity_uploadSecure($tfile));
-        $serendipity['POST']['target_directory'] = serendipity_uploadSecure($serendipity['POST']['target_directory'], true);
+        $serendipity['POST']['target_directory'] = serendipity_uploadSecure($serendipity['POST']['target_directory'], true, true);
         $target = $serendipity['serendipityPath'] . $serendipity['uploadPath'] . $serendipity['POST']['target_directory'] . $tfile;
 
         if (file_exists($target)) {
@@ -177,7 +182,7 @@ switch ($serendipity['GET']['adminAction']) {
         }
 
         $tfile = serendipityNormalizeFilename(serendipity_uploadSecure($tfile));
-        $serendipity['POST']['target_directory'] = serendipity_uploadSecure($serendipity['POST']['target_directory'], true);
+        $serendipity['POST']['target_directory'] = serendipity_uploadSecure($serendipity['POST']['target_directory'], true, true);
         $target = $serendipity['serendipityPath'] . $serendipity['uploadPath'] . $serendipity['POST']['target_directory'] . $tfile;
 
         if (file_exists($target)) {

diff --git a/include/functions_images.inc.php b/include/functions_images.inc.php
index 3d38e9a498357e64f90f9e5379f82147e6c0f56c..d069ecb776fb84380d0f2a10151bed60e56c618c 100644 (file)
--- a/include/functions_images.inc.php
+++ b/include/functions_images.inc.php
@@ -10,6 +10,9 @@ function serendipityNormalizeFilename($in) {
     return $out;
 }
 
+function serendipity_isSafeFile($file) {
+    return preg_match('@\.(php[34]?|[psj]html?|aspx?|cgi|jsp|py|pl)$@i', $file);
+}
 
 /**
 * Get a list of images
@@ -1236,13 +1239,19 @@ function serendipity_deletePath($dir) {
     }
 }
 
-function serendipity_uploadSecure($var, $strip_paths = true) {
+function serendipity_uploadSecure($var, $strip_paths = true, $append_slash = false) {
     $var = preg_replace('@[^0-9a-z\._/-]@i', '', $var);
     if ($strip_paths) {
         $var = preg_replace('@(\.+[/\\\\]+)@', '/', $var);
     }
 
     $var = preg_replace('@^(/+)@', '', $var);
+    
+    if ($append_slash) {
+        if (substr($var, -1, 1) != '/') {
+            $var .= '/';
+        }
+    }
 
     return $var;
 }