From 41249220df2ad7c659e23040f8abf0909d6e7f29 Mon Sep 17 00:00:00 2001 From: marcos Date: Tue, 11 Aug 2020 09:11:37 +0200 Subject: [PATCH] fixed vilnerability with filename incidents --- pandora_console/operation/incidents/incident_detail.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pandora_console/operation/incidents/incident_detail.php b/pandora_console/operation/incidents/incident_detail.php index 7e80ac93cf..56cb339218 100755 --- a/pandora_console/operation/incidents/incident_detail.php +++ b/pandora_console/operation/incidents/incident_detail.php @@ -137,11 +137,11 @@ if (isset($_GET['id'])) { } // Upload file - if ((check_acl($config['id_user'], $id_grupo, 'IW') == 1) and isset($_GET['upload_file']) and ($_FILES['userfile']['name'] != '')) { + if ((check_acl($config['id_user'], $id_grupo, 'IW') == 1) && isset($_GET['upload_file']) && ($_FILES['userfile']['name'] != '')) { $description = get_parameter('file_description', __('No description available')); // Insert into database - $filename = io_safe_input($_FILES['userfile']['name']); + $filename = strip_tags(io_safe_input($_FILES['userfile']['name']), '
'); $filesize = io_safe_input($_FILES['userfile']['size']); // The following is if you have clamavlib installed