Thomas/Piwigo_Bratonien_Tools
1
0
Fork 0
mirror of https://github.com/Terranom674/Piwigo_Bratonien_Tools.git synced 2026-09-19 15:14:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix stored watermark path handling

Browse Source
This commit is contained in:
Terranom674
2026-08-15 14:58:29 +02:00
parent 83cdc0c26e
commit 170f86f84f
1 changed files with 27 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
include/watermark_runtime.inc.php
View File

@@ -55,7 +55,7 @@ function bratonien_tools_runtime_effective_rule($category_id)
function bratonien_tools_runtime_sign($rel_url, $profile_id) function bratonien_tools_runtime_sign($rel_url, $profile_id)
{ {
global $conf; global $conf;
$key = !empty($conf['secret_key']) ? $conf['secret_key'] : $conf['db_password']; $key = !empty($conf['secret_key']) ? $conf['secret_key'] : ($conf['db_password'] ?? 'bratonien-tools');
return hash_hmac('sha256', $profile_id.'|'.$rel_url, $key); return hash_hmac('sha256', $profile_id.'|'.$rel_url, $key);
} }
@@ -64,6 +64,30 @@ function bratonien_tools_runtime_b64url_encode($value)
return rtrim(strtr(base64_encode($value), '+/', '-_'), '='); return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
} }
function bratonien_tools_profile_watermark_path(array $profile)
{
if (empty($profile['watermark_file']))
{
return null;
}
$relative = ltrim((string)$profile['watermark_file'], '/');
$allowed_prefix = trim(PWG_LOCAL_DIR, '/').'/watermarks/';
if (strpos($relative, $allowed_prefix) !== 0)
{
return null;
}
$root = realpath(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks');
$path = realpath(PHPWG_ROOT_PATH.$relative);
if (!$root || !$path || strpos($path, $root.DIRECTORY_SEPARATOR) !== 0 || !is_file($path))
{
return null;
}
return $path;
}
function bratonien_tools_filter_derivative_url($url, $params, $src_image, $rel_url) function bratonien_tools_filter_derivative_url($url, $params, $src_image, $rel_url)
{ {
if (!bratonien_tools_watermark_engine_enabled()) if (!bratonien_tools_watermark_engine_enabled())
@@ -78,13 +102,12 @@ function bratonien_tools_filter_derivative_url($url, $params, $src_image, $rel_u
} }
$profile = bratonien_tools_get_watermark_profile((int)$rule['profile_id']); $profile = bratonien_tools_get_watermark_profile((int)$rule['profile_id']);
if (!$profile || empty($profile['active']) || empty($profile['watermark_file'])) if (!$profile || empty($profile['active']))
{ {
return $url; return $url;
} }
$watermark_path = PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks/'.$profile['watermark_file']; if (!bratonien_tools_profile_watermark_path($profile))
if (!is_file($watermark_path))
{ {
return $url; return $url;
} }