mirror/moodle-auth_outage
1
0
Fork 0
mirror of https://github.com/catalyst/moodle-auth_outage.git synced 2026-09-07 08:11:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

WR #490867 auth_outage Review changes - sanitise header metadata and file request parameters, restrict served mime types, guard warning bar css output, move svgicons config change out of constructor, add missing form field types

Browse Source
This commit is contained in:
Waleed Hassan
2026-07-12 22:15:41 +01:00
parent 675ec899f4
commit 6aad6d37ba
5 changed files with 32 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
file.php
+20 -3
View File
@@ -37,14 +37,31 @@ if (!isset($_GET['file'])) {
die('Missing file parameter.');
}
$parts = explode('.', $_GET['file']);
$rawfile = $_GET['file'];
if (!preg_match('/^[a-zA-Z0-9_\-\.\/]+$/', $rawfile)) {
http_response_code(400);
die('Invalid file parameter.');
}
$parts = explode('.', $rawfile);
if (count($parts) != 2) {
http_response_code(400);
die('Invalid file requested.');
}
$mime = base64_decode($parts[1]);
$extension = strtolower(pathinfo($parts[0], PATHINFO_EXTENSION));
$allowedmimes = [
'css' => 'text/css',
'png' => 'image/png',
'jpg' => 'image/jpeg',
'jpeg' => 'image/jpeg',
'gif' => 'image/gif',
];
if (!array_key_exists($extension, $allowedmimes)) {
http_response_code(400);
die('Unsupported file type.');
}
$mime = $allowedmimes[$extension];
// Detect type, we only support css or PNG images.
header('Content-Type: ' . $mime);
// Use cache.