On 23/08/12 18:45, Holger Motzkau wrote:
> Hej!
>
> Our installation and our plugins are all up to date.
>
> The problem is the haybase-plugin which we installed to use the blue
> Dutch WLM skin. It contains a file called timthumb.php with the
> following code:
>
> // external domains that are allowed to be displayed on your website
> $allowedSites = array (
> 'flickr.com',
> 'picasa.com',
> 'blogger.com',
> 'wordpress.com',
> 'img.youtube.com',
> 'upload.wikimedia.org',
> );
>
> [...]
>
> foreach ($allowedSites as $site) {
> if (strpos (strtolower ($url_info['host']), $site) !== false) {
> $isAllowedSite = true;
> }
> }
Seems all websites will need an update.
The above code can be rewritten as:
if (preg_match( '/(^|\.)(' . str_replace( ".", "\.", implode("|",
$allowedSites ) ) . ")$/", $url_info['host'] ) { $isAllowedSite = true;}
> And the check there is stupid. It just checks if an external url
> contains flickr.com, not if the url is actually flickr.com. Using
> this, manipulated gif images were downloaded from
> http://flickr.com.aseana.com.my/xc0de.php and ended up in the cache
> folder for scaled images where it later was executed as php files.
Still, even hardening the above check, the cache folder should not be
publicly accessible or executable as php.
Malicious code could be present at those domains, too.
_______________________________________________
Wiki Loves Monuments mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikilovesmonuments
http://www.wikilovesmonuments.org
