FreshRSS
/
FreshRSS
mirror of https://github.com/FreshRSS/FreshRSS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Security fix in ext.php (#4928) 

Details later.
Due to https://github.com/FreshRSS/FreshRSS/pull/3433 (1.18.0)
This commit is contained in:
Alexandre Alapetite 2022-12-08 10:25:57 +01:00
parent b835c426d4
commit 62afc060a8
No known key found for this signature in database
GPG Key ID: A24378C38E812B23
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
p/ext.php
View File

@ -101,7 +101,8 @@ if (!isset($_GET['f']) ||
$file_name = urldecode($_GET['f']);
$file_type = $_GET['t'];
if (empty(SUPPORTED_TYPES[$file_type])) {
if (empty(SUPPORTED_TYPES[$file_type]) ||
empty(SUPPORTED_TYPES[pathinfo($file_name, PATHINFO_EXTENSION)])) {
sendBadRequestResponse('File type is not supported.');
}