Changeset 1727

Timestamp:

10/02/2004 12:46:30 AM (21 years ago)

Author:

emc3

Message:

Security: Clean up user inputs before using.

Location:

trunk

Files:

• wp-admin/upload.php (modified) (3 diffs)
• wp-includes/functions.php (modified) (1 diff)

trunk/wp-admin/upload.php

@@ -81 +81 @@
 <?php //Makes sure they choose a file
 
-//print_r($HTTP_POST_FILES);
+//print_r($_FILES);
 //die();
 
 
-    $imgalt = (isset($_POST['imgalt'])) ? $_POST['imgalt'] : $imgalt;
-
-    $img1_name = (strlen($imgalt)) ? $_POST['imgalt'] : $HTTP_POST_FILES['img1']['name'];
-    $img1_type = (strlen($imgalt)) ? $_POST['img1_type'] : $HTTP_POST_FILES['img1']['type'];
-    $imgdesc = str_replace('"', '&amp;quot;', $_POST['imgdesc']);
+    $imgalt = basename( (isset($_POST['imgalt'])) ? $_POST['imgalt'] : '' );
+
+    $img1_name = (strlen($imgalt)) ? $imgalt : basename( $_FILES['img1']['name'] );
+    $img1_type = (strlen($imgalt)) ? $_POST['img1_type'] : $_FILES['img1']['type'];
+    $imgdesc = htmlentities2($imgdesc);
 
     $imgtype = explode(".",$img1_name);
@@ -100 +100 @@
     if (strlen($imgalt)) {
         $pathtofile = get_settings('fileupload_realpath')."/".$imgalt;
-        $img1 = $_POST['img1'];
+        $img1 = $_POST['img1']['tmp_name'];
     } else {
         $pathtofile = get_settings('fileupload_realpath')."/".$img1_name;
-        $img1 = $HTTP_POST_FILES['img1']['tmp_name'];
+        $img1 = $_FILES['img1']['tmp_name'];
     }
 
@@ -192 +192 @@
         }
         elseif($_POST['thumbsize'] == 'custom') {
-            $max_side = $_POST['imgthumbsizecustom'];
+            $max_side = intval($_POST['imgthumbsizecustom']);
         }
         

trunk/wp-includes/functions.php

@@ -1717 +1717 @@
 }
 
+// Borrowed from the PHP Manual user notes. Convert entities, while
+// preserving already-encoded entities:
+function htmlentities2($myHTML) {
+    $translation_table=get_html_translation_table (HTML_ENTITIES,ENT_QUOTES);
+    $translation_table[chr(38)] = '&';
+    return preg_replace("/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/","&" , strtr($myHTML, $translation_table));
+}
+
 ?>