mirror/opensourcepos
1
0 Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-09-18 00:17:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): sanitize filenames and escape logo path in config (#4630)

Browse Source 
* fix(security): sanitize filenames and escape logo path in config

- Sanitize uploaded filename in Config.php via preg_replace, strip
  chars outside [a-zA-Z0-9_-] before storing raw_name
- Escape $logo_src with esc(..., 'attr') in info_config.php view to
  prevent XSS via crafted logo path/filename

Prevents stored XSS and path traversal from unsanitized filenames
used in config uploads.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>

* fix(config): sanitize uploaded config filenames

Replace inline regex filename sanitization with sanitize_filename()
helper to prevent path traversal via crafted upload filenames.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>

---------

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>
Co-authored-by: Travis Garrison <travis@chiraqbookstore.com>
This commit is contained in:
objecttothisandTravis Garrison authored and GitHub committed 2026-08-07 20:30:02 +04:00
1 parent aa96ad0284
commit f5ba1709eb
2 files changed
+3 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/Controllers/Config.php
+2 -1
View File
@@ -349,10 +349,11 @@ class Config extends Secure_Controller
$filename = $file->getClientName();
$info = pathinfo($filename);
helper('security');
$file_info = [
'orig_name' => $filename,
'raw_name' => $info['filename'],
'raw_name' => sanitize_filename($info['filename']),
'file_ext' => $file->guessExtension()
];
app/Views/configs/info_config.php
+1 -1
View File
@@ -36,7 +36,7 @@
<div class="fileinput <?= $logo_exists ? 'fileinput-exists' : 'fileinput-new' ?>" data-provides="fileinput">
<div class="fileinput-new thumbnail" style="width: 200px; height: 200px;"></div>
<div class="fileinput-preview fileinput-exists thumbnail" style="max-width: 200px; max-height: 200px;">
<img data-src="holder.js/100%x100%" alt="<?= esc(lang('Config.company_logo')) ?>" src="<?= $logo_src ?>" style="max-height: 100%; max-width: 100%;">
<img data-src="holder.js/100%x100%" alt="<?= esc(lang('Config.company_logo')) ?>" src="<?= esc($logo_src, 'attr') ?>" style="max-height: 100%; max-width: 100%;">
</div>
<div>
<span class="btn btn-default btn-sm btn-file">