From c3d14e1fa54c7dade7b1b7955575e2991396d7ef Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Mon, 14 Sep 2020 19:46:52 +0300 Subject: - fix multiple vulnerabilities in af_proxy_http - fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized - fetch_file_contents: validate all URLs before requesting them - validate URLs: explicitly whitelist http and https scheme, forbid everything else - DiskCache/cached_url: only serve whitelisted content types (images, video) - simplify filename/URL handling code, remove and consolidate some less-used functions --- classes/handler/public.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'classes/handler/public.php') diff --git a/classes/handler/public.php b/classes/handler/public.php index e6d94e223..135cdcbc7 100755 --- a/classes/handler/public.php +++ b/classes/handler/public.php @@ -1234,7 +1234,7 @@ class Handler_Public extends Handler { public function pluginhandler() { $host = new PluginHost(); - $plugin_name = clean_filename($_REQUEST["plugin"]); + $plugin_name = basename(clean($_REQUEST["plugin"])); $method = clean($_REQUEST["pmethod"]); $host->load($plugin_name, PluginHost::KIND_USER, 0); -- cgit v1.2.3