fix: security issue with image upload (#175)

ellite · Mar 1, 2024 · 7b5e166 · 7b5e166
1 parent 33a39c7
commit 7b5e166
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/endpoints/payments/add.php b/endpoints/payments/add.php
@@ -65,7 +65,8 @@ function saveLogo($imageData, $uploadFile, $name) {
         }
     }
 
-    function resizeAndUploadLogo($uploadedFile, $uploadDir, $name) {        $targetWidth = 70;
+    function resizeAndUploadLogo($uploadedFile, $uploadDir, $name) {        
+        $targetWidth = 70;
         $targetHeight = 48;
 
         $timestamp = time();
@@ -154,6 +155,15 @@ function resizeAndUploadLogo($uploadedFile, $uploadDir, $name) {        $targetW
                 $icon = getLogoFromUrl($iconUrl, '../../images/uploads/logos/', $name);
             } else {
                 if (!empty($_FILES['paymenticon']['name'])) {
+                    $fileType = mime_content_type($_FILES['paymenticon']['tmp_name']);
+                    if (strpos($fileType, 'image') === false) {
+                        $response = [
+                            "success" => false,
+                            "errorMessage" => translate('fill_all_fields', $i18n)
+                        ];
+                        echo json_encode($response);
+                        exit();
+                    }
                     $icon = resizeAndUploadLogo($_FILES['paymenticon'], '../../images/uploads/logos/', $name);
                 }
             }

diff --git a/endpoints/subscription/add.php b/endpoints/subscription/add.php
@@ -157,6 +157,11 @@ function resizeAndUploadLogo($uploadedFile, $uploadDir, $name) {
                 $logo = getLogoFromUrl($logoUrl, '../../images/uploads/logos/', $name);
             } else {
                 if (!empty($_FILES['logo']['name'])) {
+                    $fileType = mime_content_type($_FILES['logo']['tmp_name']);
+                    if (strpos($fileType, 'image') === false) {
+                        echo translate("fill_all_fields", $i18n);
+                        exit();
+                    }
                     $logo = resizeAndUploadLogo($_FILES['logo'], '../../images/uploads/logos/', $name);
                 }
             }