jenkins-bot has submitted this change and it was merged.
Change subject: When checking whitelist of extensions, only count last
extension.
......................................................................
When checking whitelist of extensions, only count last extension.
When we are doing blacklisted extensions, we count all extensions
as some programs (like apache sometimes) consider extensions that
aren't the final extension. However when doing whitelists we need
to only count the last extension, otherwise people can name files
foo.goodExt.BadExt. For example [[commons:File:Deamado ko.png.bmp]]
I do not believe this represents a security risk as bad files are
still filtered out. However it does allow unwanted files to be
uploaded.
Bug: 62451
Change-Id: Ie27c15f749812710571f432bc5915e498f8017e3
---
M includes/upload/UploadBase.php
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
CSteipp: Looks good to me, approved
jenkins-bot: Verified
diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index db7a24e..6cce4ac 100644
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -786,7 +786,7 @@
return $this->mTitle;
} elseif ( $blackListedExtensions ||
( $wgCheckFileExtensions &&
$wgStrictFileExtensions &&
- !$this->checkFileExtensionList( $ext,
$wgFileExtensions ) ) ) {
+ !$this->checkFileExtension(
$this->mFinalExtension, $wgFileExtensions ) ) ) {
$this->mBlackListedExtensions = $blackListedExtensions;
$this->mTitleError = self::FILETYPE_BADTYPE;
$this->mTitle = null;
--
To view, visit https://gerrit.wikimedia.org/r/117668
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ie27c15f749812710571f432bc5915e498f8017e3
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Brian Wolff <[email protected]>
Gerrit-Reviewer: Aaron Schulz <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: Gergő Tisza <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
