Parameters imgw and imgh of image.php must be checked inside this file.

I'm sorry, my English is not good.

CommentFileSizeAuthor
#3 node566184.diff1015 bytesdrpchris
#1 node566184.diff591 bytesdrpchris

Comments

drpchris’s picture

drpchris commented
StatusFileSize
new node566184.diff591 bytes

diff to fix this against the Aug-03 dev release. CHecks that there are only decimal chars in the params.

drpchris’s picture

drpchris commented
Version: 6.x-3.4 » 6.x-3.x-dev
Assigned: Unassigned » drpchris
Priority: Normal » Critical
Status: Active » Needs review
drpchris’s picture

drpchris commented
StatusFileSize
new node566184.diff1015 bytes

this patch obsoletes the first one. Adds a check for '..' in the image path. I also diff'd the old one backwards.

api87’s picture

api87 commented

Also we need check that width and heigth are in correct range ( for ex., imgw>10 and imgw<10000)

drpchris’s picture

drpchris commented
Status: Needs review » Closed (fixed)

This patch has been incorporated into http://drupal.org/node/566178