tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Reject invalid uploads and expand flow tests.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 716a609f4e
commit 8f4851e576
9 changed files with 427 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/post.lib.php
+23 -9
View File
@@ -157,8 +157,11 @@ function get_mimetype($image_file) {
function save_uploaded_file() {
// A new upload in this request: PHP removes the file after the request
if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
return $_FILES['upload']['tmp_name'];
$upload_tmp = $_FILES['upload']['tmp_name'] ?? '';
if (!is_string($upload_tmp))
return FALSE;
if (is_uploaded_file($upload_tmp)) {
return $upload_tmp;
}
// An image uploaded at the preview step; the session knows which one
if (($_POST['uploaded'] ?? '') === 'pending') {
@@ -188,6 +191,7 @@ function validate_data() {
extract($result[0], EXTR_OVERWRITE);
$upload_error = $_FILES['upload']['error'] ?? UPLOAD_ERR_NO_FILE;
$upload_tmp = $_FILES['upload']['tmp_name'] ?? '';
$upload_name = $_FILES['upload']['name'] ?? '';
// Visitors must solve the captcha before a preview or a save
if (!$is_admin && !captcha_check()) {
@@ -206,22 +210,32 @@ function validate_data() {
$validate['story'] = "You've tried to remove an image without replacing it with text.";
}
if (!is_array($_FILES['upload'] ?? array()) || !is_int($upload_error) ||
!is_string($upload_tmp) || !is_string($upload_name)) {
$validate['upload'] = 'The upload is invalid. Please choose the image again.';
return TRUE;
}
if ($upload_error === UPLOAD_ERR_NO_FILE)
return TRUE;
$upload_max = upload_max_bytes();
$too_large = htmlspecialchars((string)($_FILES['upload']['name'] ?? '')) .
$too_large = htmlspecialchars($upload_name) .
($upload_max === NULL ? ' is larger than the server accepts.' : ' is larger than '.upload_max_mb().' MB.') .
' Please choose a smaller image.';
// 0 == no error; 4 == no file; all others are errors.
if ($upload_error === UPLOAD_ERR_INI_SIZE || $upload_error === UPLOAD_ERR_FORM_SIZE) {
$validate['upload'] = $too_large;
} else if ($upload_error > 0 &&
$upload_error !== 4) {
} else if ($upload_error !== UPLOAD_ERR_OK) {
$validate['upload'] = 'There was an error uploading the file ('.$upload_error.')';
} else if ($upload_tmp && $upload_max !== NULL && (int)@filesize($upload_tmp) > $upload_max) {
} else if ($upload_tmp === '' || !is_file($upload_tmp) || !is_readable($upload_tmp)) {
$validate['upload'] = 'The uploaded file is unavailable. Please choose the image again.';
} else if ($upload_max !== NULL && (int)@filesize($upload_tmp) > $upload_max) {
$validate['upload'] = $too_large;
} else if ($upload_tmp) {
$upload = getimagesize($upload_tmp);
} else {
// The file can disappear after the check above, or contain incomplete image data.
$upload = @getimagesize($upload_tmp);
if (!$upload)
$validate['upload'] = htmlspecialchars($_FILES['upload']['name']) .
$validate['upload'] = htmlspecialchars($upload_name) .
" wasn't an image file. Please go back.";
}
return TRUE;
publish/preview.inc.php
+2 -2
View File
@@ -7,8 +7,8 @@ echo '<p>Please review your submission. Once you\'ve finished, please click "Sub
// Keep a new image outside the web root until the story is saved;
// display.php shows it to this session only. A request that failed the
// captcha or the form token keeps nothing.
if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') &&
!isset($validate['upload']) && !isset($validate['captcha']) && !isset($validate['csrf'])) {
if (!isset($validate['upload']) && !isset($validate['captcha']) && !isset($validate['csrf']) &&
is_string($_FILES['upload']['tmp_name'] ?? '') && is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
if (store_upload($_FILES['upload']['tmp_name']))
$file_src = pending_upload_url();
else