admin/Studio-42-elFinder
1
0
Fork 0
mirror of https://github.com/Studio-42/elFinder synced 2026-06-08 12:37:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

[security] fix #3458 filename bypass leading to RCE on Windows server (#3470)

Browse Source 
Windows servers do not allow "." (Dots) at the end of a file name.
This commit is contained in:
Naoki Sawada
2022-03-10 00:05:21 +09:00
committed by GitHub
parent 79decc04e2
commit 69be51eea5
3 changed files with 141 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/elFinderVolumeLocalFileSystem.class.php
+8
View File
@@ -265,6 +265,14 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
}
$this->statOwner = (!empty($this->options['statOwner']));
// enable WinRemoveTailDots plugin on Windows server
if (DIRECTORY_SEPARATOR !== '/') {
if (!isset($this->options['plugin'])) {
$this->options['plugin'] = array();
}
$this->options['plugin']['WinRemoveTailDots'] = array('enable' => true);
}
}
/**