Friendica/friendica
Friendica/friendica
1
0
Fork 1
mirror of https://git.friendi.ca/friendica/friendica.git synced 2025-06-17 01:25:21 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Security issue: Encoding of GUID in itemcache to avoid directory bypassing with a malificious formatted GUID.

Browse source
This commit is contained in:
Michael Vogel 2014-09-27 12:49:00 +02:00
parent 4ec5974074
commit 459fc2fabd
5 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
include/items.php
View file

@ -1412,7 +1412,7 @@ function item_store($arr,$force_parent = false, $notify = false) {
if (!$deleted) {
// Store the fresh generated item into the cache
$cachefile = get_cachefile($arr["guid"]."-".hash("md5", $arr['body']));
$cachefile = get_cachefile(urlencode($arr["guid"])."-".hash("md5", $arr['body']));
if (($cachefile != '') AND !file_exists($cachefile)) {
$s = prepare_text($arr['body']);