tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[Console] Added a notice to warn the users about the php files uploaded with the files manager

This commit is contained in:
Alejandro Gallardo Escobar 2017-10-30 16:04:58 +01:00
parent c687e6a97b
commit 64ec82f9d6
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pandora_console/include/functions_filemanager.php
View File

@ -720,6 +720,17 @@ function filemanager_file_explorer($real_directory, $relative_directory,
$hash = md5($relative_path . $config['dbpass']);
$data[1] = '<a href="' . $hack_metaconsole . 'include/get_file.php?file='.urlencode(base64_encode($relative_path)).'&hash=' . $hash . '">'.$fileinfo['name'].'</a>';
}
// Notice that uploaded php files could be dangerous
if (pathinfo($fileinfo['realpath'], PATHINFO_EXTENSION) == 'php' &&
(is_readable($fileinfo['realpath']) || is_executable($fileinfo['realpath']))) {
$error_message = __('This file could be executed by any user');
$error_message .= '. ' . __('Make sure it can\'t perform dangerous tasks');
$data[1] = '<span class="error forced_title" data-title="' . $error_message . '" data-use_title_for_force_title="1">'
. $data[1]
. '</span>';
}
$data[2] = ui_print_timestamp ($fileinfo['last_modified'], true,
array ('prominent' => true));
if ($fileinfo['is_dir']) {