tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Keep uploads outside the web root.

Browse Source 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
This commit is contained in:
tim
2026-09-25 21:31:47 +02:00
parent c85f54116c
commit e881ddb458
7 changed files with 104 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/preview.inc.php
+7 -8
View File
@@ -23,14 +23,13 @@ if (isset($_POST['g-recaptcha-response'])) {
echo '<p>Please review your submission. Once you\'ve finished, please click "Submit" at the bottom of the page, or click "Preview" to check it again.</p>';
if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') &&!isset($validate['upload'])) {
$tmp_file = $_FILES['upload']['tmp_name'];
$upload = getimagesize($tmp_file);
$new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
move_uploaded_file($tmp_file, $new_file);
$file_src = "/graphics" .$tmp_file;
} else if (isset($uploaded) && is_file($_SERVER['DOCUMENT_ROOT'] . $uploaded) && !$remove_img) {
$file_src = $uploaded;
// Keep a new image outside the web root until the story is saved;
// display.php shows it to this session only.
if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') && !isset($validate['upload'])) {
if (store_upload($_FILES['upload']['tmp_name']))
$file_src = pending_upload_url();
} else if (isset($uploaded) && $uploaded === 'pending' && pending_upload() && !$remove_img) {
$file_src = pending_upload_url();
}
echo display_stories();