From 487afc371e5c0dfbbc07cd002333c5bcd949d0f4 Mon Sep 17 00:00:00 2001 From: FusionPBX Date: Wed, 3 Nov 2021 15:30:01 -0600 Subject: [PATCH] Change the fax file name to md5 to avoid characters that present a security risk. --- app/fax/fax_send.php | 26 ++++---------------------- 1 file changed, 4 insertions(+), 22 deletions(-) diff --git a/app/fax/fax_send.php b/app/fax/fax_send.php index 451db849d0..722088ba87 100644 --- a/app/fax/fax_send.php +++ b/app/fax/fax_send.php @@ -351,28 +351,10 @@ if (!function_exists('fax_split_dtmf')) { $disallowed_file_extensions = explode(',','sh,ssh,so,dll,exe,bat,vbs,zip,rar,z,tar,tbz,tgz,gz'); if (in_array($fax_file_extension, $disallowed_file_extensions) || $fax_file_extension == '') { continue; } - $fax_name = $_files['name'][$index]; - $fax_name = preg_replace('/\\.[^.\\s]{3,4}$/', '', $fax_name); - $fax_name = str_replace(" ", "_", $fax_name); - - //lua doesn't seem to like special chars with env:GetHeader - $fax_name = str_replace(";", "_", $fax_name); - $fax_name = str_replace(",", "_", $fax_name); - $fax_name = str_replace("'", "_", $fax_name); - $fax_name = str_replace("!", "_", $fax_name); - $fax_name = str_replace("@", "_", $fax_name); - $fax_name = str_replace("#", "_", $fax_name); - $fax_name = str_replace("$", "_", $fax_name); - $fax_name = str_replace("%", "_", $fax_name); - $fax_name = str_replace("^", "_", $fax_name); - $fax_name = str_replace("`", "_", $fax_name); - $fax_name = str_replace("~", "_", $fax_name); - $fax_name = str_replace("&", "_", $fax_name); - $fax_name = str_replace("(", "_", $fax_name); - $fax_name = str_replace(")", "_", $fax_name); - $fax_name = str_replace("+", "_", $fax_name); - $fax_name = str_replace("=", "_", $fax_name); + //use a safe file name + $fax_name = md5($_files['name'][$index]); + //rename the file $attachment_file_name = $_files['name'][$index]; if ($attachment_file_name != $fax_name.'.'.$fax_file_extension) { rename($dir_fax_temp.'/'.$attachment_file_name, $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension); @@ -382,7 +364,7 @@ if (!function_exists('fax_split_dtmf')) { if (!$included) { //check if directory exists if (!is_dir($dir_fax_temp)) { - event_socket_mkdir($dir_fax_temp); + mkdir($dir_fax_temp, 0770); } //move uploaded file move_uploaded_file($_files['tmp_name'][$index], $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);