Thomas/Piwigo_Bratonien_Tools
1
0
Fork 0
mirror of https://github.com/Terranom674/Piwigo_Bratonien_Tools.git synced 2026-09-19 11:44:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use validated watermark profile paths in renderer

Browse Source
This commit is contained in:
Terranom674
2026-08-15 14:58:52 +02:00
parent 170f86f84f
commit 2958fe7eeb
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
watermark.php
View File

@@ -75,7 +75,7 @@ function bratonien_tools_fetch_derivative($rel_url, $physical_path)
CURLOPT_CONNECTTIMEOUT => 5,
CURLOPT_TIMEOUT => 30,
CURLOPT_FAILONERROR => true,
CURLOPT_USERAGENT => 'BratonienTools/0.2',
CURLOPT_USERAGENT => 'BratonienTools/0.2.1',
));
$data = curl_exec($ch);
curl_close($ch);
@@ -152,14 +152,13 @@ if (!hash_equals($expected, $signature))
}
$profile = bratonien_tools_get_watermark_profile($profile_id);
if (!$profile || empty($profile['active']) || empty($profile['watermark_file']))
if (!$profile || empty($profile['active']))
{
bratonien_tools_watermark_fail(404, 'Watermark profile unavailable');
}
$watermark_root = realpath(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks');
$watermark_path = realpath(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks/'.$profile['watermark_file']);
if (!$watermark_root || !$watermark_path || strpos($watermark_path, $watermark_root.DIRECTORY_SEPARATOR) !== 0 || !is_file($watermark_path))
$watermark_path = bratonien_tools_profile_watermark_path($profile);
if (!$watermark_path)
{
bratonien_tools_watermark_fail(404, 'Watermark file unavailable');
}