Fixed: Secure the uploads
Reopened after report of a bug (only on *nix systems) by Shrilesh Korgaonkar.
This fixes the issue
Thanks: Shrilesh Korgaonkar
@@ -116,21 +116,23 @@ public class SecuredUpload {
} else if (p.toString().contains(imageServerUrl.replaceAll("/", "\\\\"))) {
if (file.matches("[a-zA-Z0-9-_ ()]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) { // "(" and ")" for duplicates files
wrongFile = false;
- } else if (!file.matches("[a-zA-Z0-9-_ ]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) {
- wrongFile = false;
}
+ } else if (file.matches("[a-zA-Z0-9-_ ]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) {
+ wrongFile = false;
}
- } else {
+ } else { // Suppose a *nix system
if (fileToCheck.length() > 4096) {
Debug.logError("Uploaded file name too long", MODULE);
return false;
} else if (p.toString().contains(imageServerUrl)) {
if (file.matches("[a-zA-Z0-9-_ ()]{1,4086}.[a-zA-Z0-9-_ ]{1,10}")) { // "(" and ")" for duplicates files
wrongFile = false;
- } else if (!file.matches("[a-zA-Z0-9-_ ]{1,4086}.[a-zA-Z0-9-_ ]{1,10}")) {
+ }
+ } else if (file.matches("[a-zA-Z0-9-_ ]{1,4086}.[a-zA-Z0-9-_ ]{1,10}")) {
wrongFile = false;
}
}
+
if (wrongFile) {
Debug.logError("Uploaded file "
+ " should contain only Alpha-Numeric characters, hyphen, underscore and spaces,"
@@ -139,7 +141,6 @@ public class SecuredUpload {
MODULE);
return false;
}
- }
if (isExecutable(fileToCheck)) {
return false;
