Thomas/Piwigo_Bratonien_Tools
1
0
Fork 0
mirror of https://github.com/Terranom674/Piwigo_Bratonien_Tools.git synced 2026-09-19 22:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use validated watermark profile paths in renderer

Browse Source
This commit is contained in:
Terranom674
2026-08-15 14:58:52 +02:00
parent 170f86f84f
commit 2958fe7eeb
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
watermark.php
View File

@@ -75,7 +75,7 @@ function bratonien_tools_fetch_derivative($rel_url, $physical_path)
CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_CONNECTTIMEOUT => 5,
CURLOPT_TIMEOUT => 30, CURLOPT_TIMEOUT => 30,
CURLOPT_FAILONERROR => true, CURLOPT_FAILONERROR => true,
CURLOPT_USERAGENT => 'BratonienTools/0.2', CURLOPT_USERAGENT => 'BratonienTools/0.2.1',
)); ));
$data = curl_exec($ch); $data = curl_exec($ch);
curl_close($ch); curl_close($ch);
@@ -152,14 +152,13 @@ if (!hash_equals($expected, $signature))
} }
$profile = bratonien_tools_get_watermark_profile($profile_id); $profile = bratonien_tools_get_watermark_profile($profile_id);
if (!$profile || empty($profile['active']) || empty($profile['watermark_file'])) if (!$profile || empty($profile['active']))
{ {
bratonien_tools_watermark_fail(404, 'Watermark profile unavailable'); bratonien_tools_watermark_fail(404, 'Watermark profile unavailable');
} }
$watermark_root = realpath(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks'); $watermark_path = bratonien_tools_profile_watermark_path($profile);
$watermark_path = realpath(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'watermarks/'.$profile['watermark_file']); if (!$watermark_path)
if (!$watermark_root || !$watermark_path || strpos($watermark_path, $watermark_root.DIRECTORY_SEPARATOR) !== 0 || !is_file($watermark_path))
{ {
bratonien_tools_watermark_fail(404, 'Watermark file unavailable'); bratonien_tools_watermark_fail(404, 'Watermark file unavailable');
} }