#3531: ImageField - possible script injection
-------------------------------------------------+--------------------------
Reporter: Piotr Maliński <[EMAIL PROTECTED]> | Owner: adrian
Status: new | Component: Database
wrapper
Version: SVN | Keywords:
Stage: Unreviewed | Has_patch: 0
-------------------------------------------------+--------------------------
ImageField field validates files using MIME which isn't 100% ok. It will
allow uploading *py *php *pl or any other file extension when it will have
image MIME signature at the beginning:
{{{
cat image.png code.php > upload_me.php
}}}
It's dangerous for shared hosting and other where media folders can
execute scripts like PHP where <?PHP starts the code and makes the binary
image part meaningless for the interpreter
([http://www.fotosik.pl/showFullSize.php?id=3a0f587509d2b2d0 could look
like this]).
Example: [http://www.fotosik.pl/showFullSize.php?id=497419b9cfb92838
screenshot] - 11.py uploaded as image. '''Check the extensions'''
--
Ticket URL: <http://code.djangoproject.com/ticket/3531>
Django Code <http://code.djangoproject.com/>
The web framework for perfectionists with deadlines
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/django-updates?hl=en
-~----------~----~----~----~------~----~------~--~---
