fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-04 01:01:41 +09:00
Code Issues Projects Releases Packages Wiki Activity

Only allow image extensions in menu image button

Browse source 
This is NOT a security problem because this function is only accessible
to the administrator. Changing it anyway to prevent confusion.

cf. xpressengine/xe-core#2434
This commit is contained in:
Kijin Sung 2022-01-01 21:40:34 +09:00
parent 4153b10645
commit 411b8e4656
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/menu/menu.admin.controller.php
View file

@ -1569,7 +1569,7 @@ class menuAdminController extends menu
Context::set('error_messge', lang('msg_invalid_request'));
}
else if(!$target_file || !is_uploaded_file($target_file['tmp_name']) || !preg_match('/\.(gif|jpeg|jpg|png)$/i',$target_file['name']))
else if(!$target_file || !is_uploaded_file($target_file['tmp_name']) || !preg_match('/\.(jpe?g|gif|png|svg|webp)$/i',$target_file['name']))
{
Context::set('error_messge', lang('msg_invalid_request'));
}
@ -2262,7 +2262,7 @@ class menuAdminController extends menu
$date = date('YmdHis');
// normal button
if($args->menu_normal_btn)
if($args->menu_normal_btn && preg_match('/\.(jpe?g|gif|png|svg|webp)$/i', $args->menu_normal_btn['name']))
{
$tmp_arr = explode('.',$args->menu_normal_btn['name']);
$ext = $tmp_arr[count($tmp_arr)-1];
@ -2272,7 +2272,7 @@ class menuAdminController extends menu
}
// hover button
if($args->menu_hover_btn)
if($args->menu_hover_btn && preg_match('/\.(jpe?g|gif|png|svg|webp)$/i', $args->menu_hover_btn['name']))
{
$tmp_arr = explode('.',$args->menu_hover_btn['name']);
$ext = $tmp_arr[count($tmp_arr)-1];
@ -2282,7 +2282,7 @@ class menuAdminController extends menu
}
// active button
if($args->menu_active_btn)
if($args->menu_active_btn && preg_match('/\.(jpe?g|gif|png|svg|webp)$/i', $args->menu_active_btn['name']))
{
$tmp_arr = explode('.',$args->menu_active_btn['name']);
$ext = $tmp_arr[count($tmp_arr)-1];