Changeset 708

Timestamp:

2007-08-23 10:49:40 (17 months ago)

Author:

wwalc

Message:

PHP connector: simplified images checking

Location:

FCKeditor/trunk/editor/filemanager/connectors/php

Files:

• commands.php (modified) (1 diff)
• sanitizer.php (deleted)
• util.php (modified) (1 diff)

FCKeditor/trunk/editor/filemanager/connectors/php/commands.php

@@ -182 +182 @@
                 if ( isset( $Config['SecureImageUploads'] ) )
                 {
-                        $imageCheckExtensions = array(
-                        'gif', 'jpeg', 'jpg', 'png', 'swf', 'psd',
-                        'bmp', 'tiff', 'tif', 'jpc', 'jp2',
-                        'jpx', 'jb2', 'swc', 'iff', 'wbmp',
-                        'xbm', 'djvu');
-
-                        if ( in_array( $sExtension, $imageCheckExtensions ) ) {
-                                if ( $Config['SecureImageUploads'] > 0 ) {
-                                        if ( @getimagesize( $oFile['tmp_name'] ) === false ) {
-                                                $sErrorNumber = '202' ;
-                                        }
-                                }
-                                if ( !$sErrorNumber && $Config['SecureImageUploads'] > 1 ) {
-                                        require_once './sanitizer.php' ;
-                                        $sanitizer = new Sanitizer();
-                                        if ( $sanitizer->detectScript( $oFile['tmp_name'] ) ) {
-                                                $sErrorNumber = '202' ;
-                                        }
-                                }
+                        if ( !IsFileValid( $oFile['tmp_name'], $sExtension, $Config['SecureImageUploads'] ) )
+                        {
+                                $sErrorNumber = '202' ;
                         }
                 }

FCKeditor/trunk/editor/filemanager/connectors/php/util.php

@@ -39 +39 @@
         return ( htmlspecialchars( $value ) ) ;
 }
+
+/**
+ * Detect HTML in the first KB to prevent against potential security issue with 
+ * IE/Safari/Opera file type auto detection bug.
+ * Returns true if file contain insecure HTML code at the beginning.
+ * 
+ * @param string $filePath absolute path to file
+ * @return boolean
+ */ 
+function DetectHtml( $filePath )
+{
+        $fp = fopen( $filePath, 'rb' ) ;
+        $chunk = fread( $fp, 1024 ) ;
+        fclose( $fp ) ;
+
+        $chunk = strtolower( $chunk ) ;
+
+        if (!$chunk) 
+        {
+                return false ;
+        }
+
+        $chunk = trim( $chunk ) ;
+
+        if ( preg_match( "/<!DOCTYPE\W*X?HTML/sim", $chunk ) ) 
+        {
+                return true;
+        }       
+
+        $tags = array( '<body', '<head', '<html', '<img', '<pre', '<script', '<table', '<title' ) ;
+
+        foreach( $tags as $tag ) 
+        {
+                if( false !== strpos( $chunk, $tag ) ) 
+                {
+                        return true ;
+                }
+        }
+
+        //type = javascript
+        if ( preg_match( '!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) 
+        {
+                return true ;
+        }
+
+        //href = javascript
+        //src = javascript
+        //data = javascript
+        if ( preg_match( '!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) )
+        {
+                return true ;
+        }
+        
+        //url(javascript
+        if ( preg_match( '!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) 
+        {
+                return true ;
+        }                       
+
+        return false ;  
+}
+
+/**
+ * Check file content.
+ * Currently this function validates only image files.
+ * Returns false if file is invalid.
+ * 
+ * @param string $filePath absolute path to file
+ * @param string $extension file extension
+ * @param integer $detectionLevel 0 = none, 1 = use getimagesize for images, 2 = use DetectHtml for images
+ * @return boolean
+ */ 
+function IsFileValid( $filePath, $extension, $detectionLevel )
+{
+        if ( $detectionLevel <= 0 ) {
+                return true;
+        }
+
+        $imageCheckExtensions = array('gif', 'jpeg', 'jpg', 'png', 'swf', 'psd', 'bmp', 'iff');
+
+        // version_compare is available since PHP4 >= 4.0.7
+        if ( function_exists( 'version_compare' ) ) {
+                $sCurrentVersion = phpversion();
+                if ( version_compare( $sCurrentVersion, "4.2.0" ) >= 0 ) {
+                        $imageCheckExtensions[] = "tiff";
+                        $imageCheckExtensions[] = "tif";
+                }
+                if ( version_compare( $sCurrentVersion, "4.3.0" ) >= 0 ) {
+                        $imageCheckExtensions[] = "swc";
+                }
+                if ( version_compare( $sCurrentVersion, "4.3.2" ) >= 0 ) {
+                        $imageCheckExtensions[] = "jpc";
+                        $imageCheckExtensions[] = "jp2";
+                        $imageCheckExtensions[] = "jpx";
+                        $imageCheckExtensions[] = "jb2";
+                        $imageCheckExtensions[] = "xbm";
+                        $imageCheckExtensions[] = "wbmp";
+                }
+        }
+        
+        if ( !in_array( $extension, $imageCheckExtensions ) ) {
+                return true;
+        }
+        
+        if ( $detectionLevel >= 1) {
+                if ( @getimagesize( $filePath ) === false ) {
+                        return false ;
+                }               
+        }
+        
+        if ( $detectionLevel >= 2) {
+                if ( DetectHtml( $filePath ) ) {
+                        return false;
+                }
+        }       
+        
+        return true;
+}
+
 ?>