bitPickups/friendica_2020-09-1_sharedHosting
1
0
Fork 0
Code Pull requests Activity

Security issue: Encoding of GUID in itemcache to avoid directory bypassing with a malificious formatted GUID.

Browse source
This commit is contained in:
Michael Vogel 2014-09-27 12:49:00 +02:00
commit 459fc2fabd
5 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
mod/item.php
View file

@ -807,7 +807,7 @@ function item_post(&$a) {
file_tag_update_pconfig($uid,$categories_old,$categories_new,'category');
// Store the fresh generated item into the cache
$cachefile = get_cachefile($datarray["guid"]."-".hash("md5", $datarray['body']));
$cachefile = get_cachefile(urlencode($datarray["guid"])."-".hash("md5", $datarray['body']));
if (($cachefile != '') AND !file_exists($cachefile)) {
$s = prepare_text($datarray['body']);