Commit 9a37bd1

authored

Merge pull request #260 from tree-chtsec/master

Fixed security issues

2 parents 43d25d8 + 9a8a7e3 commit 9a37bd1Copy full SHA for 9a37bd1

File tree

-2

lines changed

-2

lines changed

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -98,6 +98,9 @@ public BlogUser Add(BlogUser user)`
`98`	`98`	`if (!Security.IsAuthorizedTo(Rights.CreateNewUsers))`
`99`	`99`	`throw new UnauthorizedAccessException();`
`100`	`100`
	`101`	`+ if (user.UserName.Contains("/") \|\| user.UserName.Contains(@"\"))`
	`102`	`+ throw new ApplicationException("Error adding new user; Invalid character detected in UserName");`
	`103`	`+`
`101`	`104`	`// create user`
`102`	`105`	`var usr = Membership.CreateUser(user.UserName, user.Password, user.Email);`
`103`	`106`	`if (usr == null)`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ private static string BlogAbsolutePath(string VirtualPath)`
`28`	`28`	`private static string RelativeFilePath(string VirtualPath)`
`29`	`29`	`{`
`30`	`30`	`VirtualPath = VirtualPath.Replace("//","/").Trim();`
`31`		`- if (VirtualPath.ToLower().Contains(FileContainerRoot.ToLower()))`
	`31`	`+ if (VirtualPath.ToLower().Contains(FileContainerRoot.ToLower()+"/")\|\|VirtualPath.ToLower()==FileContainerRoot.ToLower())`
`32`	`32`	`return VirtualPath;`
`33`	`33`
`34`	`34`	`// ex: Oct 18 2012, added this to handle the case on the File Manager where if`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -64,6 +64,8 @@ public HttpResponseMessage Post(string action, string dirPath = "")`
`64`	`64`	`dir = BlogService.GetDirectory("/avatars");`
`65`	`65`	`var dot = fileName.LastIndexOf(".");`
`66`	`66`	`var ext = dot > 0 ? fileName.Substring(dot) : "";`
	`67`	`+ if (User.Identity.Name.Contains("/") \|\| User.Identity.Name.Contains(@"\"))`
	`68`	`+ throw new ApplicationException("Invalid character detected in UserName");`
`67`	`69`	`var profileFileName = User.Identity.Name + ext;`
`68`	`70`
`69`	`71`	`var imgPath = HttpContext.Current.Server.MapPath(dir.FullPath + "/" + profileFileName);`
`@@ -157,4 +159,4 @@ private void UploadVideo(string virtualFolder, HttpPostedFile file, string fileN`
`157`	`159`	`}`
`158`	`160`
`159`	`161`	`#endregion`
`160`		`-}`
	`162`	`+}`

Comments

(0)