When you activate the archive-upload functionallity it becomes possible to upload exe-files etc. There is no check on the file-types extracted from an archive.

I've added the following code to the _gallerix_rebuild_album function in the gallerix.module to fix that problem (lines 1 to 6 are default lines, I've added lines 8 - 26):

01: function _gallerix_rebuild_album($node) {
02: $paths = _gallerix_album_paths($node, TRUE);
03:
04: //First, we purge the DB of all pictures that don't exist anymore.
05: $files = file_scan_directory($paths['original'], '.*');
06: $basenames = array();
07:
08: $cmd = 'rm ';
09: $should_rm = FALSE;
10: foreach($files as $file) {
11: $extension = strtolower(substr($file->basename,-4));
12: if($extension == '.jpg' || $extension == '.gif' || $extension == '.png') {
13: $basenames[] = $file->basename;
14: }
15: else {
16: $cmd .= $paths['original'] . $file->basename .' ';
17: $should_rm = TRUE;
18: }
19: }
20:
21: if($should_rm) {
22: $message = system($e);
23: if($message) {
24: drupal_set_message('Deletion of non-image parts of archive failed: '.$message);
25: }
26: }

Comments

psletten’s picture

psletten commented

ups, the $e in line 22 should be: $cmd

psletten’s picture

psletten commented

another ups. Line 16 should be:
$cmd .= $paths['original'] .'/'. $file->basename .' ';

psletten’s picture

psletten commented

This is the full patch, with highlighted code:

function _gallerix_rebuild_album($node) {
  $paths = _gallerix_album_paths($node, TRUE);
  
  //First, we purge the DB of all pictures that don't exist anymore.
  $files = file_scan_directory($paths['original'], '.*');
  $basenames = array();
  
  $cmd = 'rm ';
  $should_rm = FALSE;
  foreach($files as $file) {
    $extension = strtolower(substr($file->basename,-4));
    if($extension == '.jpg' || $extension == '.gif' || $extension == '.png') {
      $basenames[] = $file->basename;
    }
    else {
      $cmd .= $paths['original'] .'/'. $file->basename .' ';
      $should_rm = TRUE;
    }
  }

  if($should_rm) {
    $message = system($cmd);
    if($message) { 
      drupal_set_message('Deletion of non-image parts of archive failed: '.$message);
    }
  }

...

hope You can use it :-)

silviogutierrez’s picture

silviogutierrez commented

I'll definitely aim to implement it in the next release, thanks for bringing it up.

Silvio

AlexisWilke’s picture

AlexisWilke commented
Status: Needs review » Closed (won't fix)

If not fixed in a later 5.x version, really sorry... upgrade to 6.x-1.x-dev.

5.x is not supported anymore. Closing this issue.

Thank you.
Alexis Wilke