Changeset 15035 for branches/rel/html/resize_image.php

Timestamp:

2007/07/10 22:12:44 (17 years ago)

Author:

adati

Message:

任意のドライブおよび、フォルダの画像ファイル等にアクセスが可能な脆弱性を修正

File:

• branches/rel/html/resize_image.php (modified) (1 diff)

branches/rel/html/resize_image.php

@@ -5 +5 @@
 
 require_once($include_dir . HTML2DATA_DIR. "lib/gdthumb.php");
-require_once($include_dir . HTML2DATA_DIR. "conf/conf.php");    
+require_once($include_dir . HTML2DATA_DIR. "conf/conf.php");
 
 $objThumb = new gdthumb();
 
-$file = $_GET["image"];
+$file = NO_IMAGE_DIR;
+
+// NO_IMAGE_DIR°Ê³°¤Î¥Õ¥¡¥¤¥ë̾¤¬ÅϤµ¤ì¤¿¾ì¹ç¡¢¥Õ¥¡¥¤¥ë̾¤Î¥Á¥§¥Ã¥¯¤ò¹Ô¤¦
+if ( isset($_GET['image']) && $_GET['image'] !== NO_IMAGE_DIR) {
+    
+    //ÉÔÀµ¤Ê¥Õ¥¡¥¤¥ë̾¤¬ÅϤµ¤ì¤¿¾ì¹ç¤Ï½ªÎ»¤µ¤»¤ë
+    if ( lfCheckFileName() !== true ) {
+        exit();
+    }
+    
+    $file = IMAGE_SAVE_DIR . $_GET['image'];
+}
+
 if(file_exists($file)){
-    $objThumb->Main($file, $_GET["width"], $_GET["height"], "", true);
+    $objThumb->Main($file, $_GET["width"], $_GET["height"], "", true);
 }else{
-    $objThumb->Main(NO_IMAGE_DIR, $_GET["width"], $_GET["height"], "", true);
+    $objThumb->Main(NO_IMAGE_DIR, $_GET["width"], $_GET["height"], "", true);
+}
+
+// ¥Õ¥¡¥¤¥ë̾¤Î·Á¼°¤ò¥Á¥§¥Ã¥¯
+function lfCheckFileName() {
+    //$pattern = '|^[0-9]+_[0-9a-z]+\.[a-z]{3}$|';
+    $pattern = '|\.\./|';
+    $file    = trim($_GET["image"]);
+    if ( preg_match_all($pattern, $file, $matches) ) {
+        return false;
+    } else {
+        return true;
+    }
 }