harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

better handling of mimetype security

Browse Source
This commit is contained in:
zotlabs 2017-03-12 21:55:24 -07:00
parent 1ee76cb506
commit fc533107ed
3 changed files with 7 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Zotlabs/Lib/System.php
View File

@ -54,8 +54,6 @@ class System {
return 'https://github.com/redmatrix/hubzilla'; return 'https://github.com/redmatrix/hubzilla';
} }
static public function get_server_role() { static public function get_server_role() {
return 'pro'; return 'pro';
} }

2
Zotlabs/Module/Editwebpage.php
View File

@ -130,8 +130,6 @@ class Editwebpage extends \Zotlabs\Web\Controller {
$layout = $itm[0]['layout_mid']; $layout = $itm[0]['layout_mid'];
$tpl = get_markup_template("jot.tpl");
$rp = 'webpages/' . $which; $rp = 'webpages/' . $which;
$x = array( $x = array(

15
Zotlabs/Module/Item.php
View File

@ -480,23 +480,14 @@ class Item extends \Zotlabs\Web\Controller {
$execflag = false; $execflag = false;
if($mimetype !== 'text/bbcode') { $z = q("select account_id, account_roles, channel_pageflags from account left join channel on channel_account_id = account_id
$z = q("select account_id, account_roles, channel_pageflags from account left join channel on channel_account_id = account_id where channel_id = %d limit 1", where channel_id = %d limit 1",
intval($profile_uid) intval($profile_uid)
); );
if($z && (($z[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($z[0]['channel_pageflags'] & PAGE_ALLOWCODE))) { if($z && (($z[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($z[0]['channel_pageflags'] & PAGE_ALLOWCODE))) {
if($uid && (get_account_id() == $z[0]['account_id'])) { if($uid && (intval(get_account_id()) == intval($z[0]['account_id']))) {
$execflag = true; $execflag = true;
} }
else {
notice( t('Executable content type not permitted to this channel.') . EOL);
if($api_source)
return ( [ 'success' => false, 'message' => 'forbidden content type' ] );
if(x($_REQUEST,'return'))
goaway(z_root() . "/" . $return_path );
killme();
}
}
} }
$gacl = $acl->get(); $gacl = $acl->get();