Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

view file is insecure #187

Closed
satyr-software opened this issue Jun 14, 2019 · 1 comment
Closed

view file is insecure #187

satyr-software opened this issue Jun 14, 2019 · 1 comment
Labels
suggestion

Comments

@satyr-software
Copy link

satyr-software commented Jun 14, 2019 •
edited
Loading

File exclusion mask is applied on listing files, but not on views:
Short test:

  • View path (let's say index.php)
  • Open file (opens fine)
  • Add to GLOBALS['exclude_items'];
  • Reload : (File still displayed)
  • Back: View path (file dissapears)

Expected result:

  • Reload should show "FIle Not Found" (excluded)

Fix:
if ($file == '' || !is_file($path . '/' . $file) || in_array($file, $GLOBALS['exclude_items'])) {

Just before:
fm_set_msg('File not found', 'error');
prasathmani pushed a commit that referenced this issue Jul 23, 2019
Some language strings are missing. And other... #192
3114fa9 
view file is insecure #187
Get files size (recursive) #186
There is no possibility for translation for some hints (title =) #185
View dirSize instead of word "Folder" #184
Document type detection #183
Stored Cross-site Scripting (XSS) Vulnerability detected in File Names #180
strings in code #177
Remove tracking #164
@prasathmani
Copy link
Owner

@satyr-software added your suggestion.

ner00 pushed a commit to ner00/tinyfilemanager that referenced this issue May 7, 2023
Some language strings are missing. And other... prasathmani#192
e686473 
view file is insecure prasathmani#187
Get files size (recursive) prasathmani#186
There is no possibility for translation for some hints (title =) prasathmani#185
View dirSize instead of word "Folder" prasathmani#184
Document type detection prasathmani#183
Stored Cross-site Scripting (XSS) Vulnerability detected in File Names prasathmani#180
strings in code prasathmani#177
Remove tracking prasathmani#164
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
suggestion
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@prasathmani @satyr-software