Skip to content

Commit c9f912b

Browse files
committed
Security: Remove curdirpath param in ajax request to upload images when enable_uploadimage_editor is enabled
1 parent 36449ab commit c9f912b

File tree

2 files changed

+4
-5
lines changed

2 files changed

+4
-5
lines changed

main/inc/ajax/document.ajax.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -219,13 +219,12 @@
219219

220220
$data = [];
221221
$fileUpload = $_FILES['upload'];
222-
$currentDirectory = Security::remove_XSS($_REQUEST['curdirpath']);
223222
$isAllowedToEdit = api_is_allowed_to_edit(null, true);
224223
if ($isAllowedToEdit) {
225224
$globalFile = ['files' => $fileUpload];
226225
$result = DocumentManager::upload_document(
227226
$globalFile,
228-
$currentDirectory,
227+
'/',
229228
'',
230229
'',
231230
0,
@@ -244,11 +243,11 @@
244243
}
245244
} else {
246245
$userId = api_get_user_id();
247-
$syspath = UserManager::getUserPathById($userId, 'system').'my_files'.$currentDirectory;
246+
$syspath = UserManager::getUserPathById($userId, 'system').'my_files';
248247
if (!is_dir($syspath)) {
249248
mkdir($syspath, api_get_permissions_for_new_directories(), true);
250249
}
251-
$webpath = UserManager::getUserPathById($userId, 'web').'my_files'.$currentDirectory;
250+
$webpath = UserManager::getUserPathById($userId, 'web').'my_files';
252251
$fileUploadName = $fileUpload['name'];
253252
if (file_exists($syspath.$fileUploadName)) {
254253
$extension = pathinfo($fileUploadName, PATHINFO_EXTENSION);

src/Chamilo/CoreBundle/Component/Editor/CkEditor/Toolbar/Basic.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ public function getConfig()
183183
$config['flash_flvPlayer'] = api_get_path(WEB_LIBRARY_JS_PATH).'ckeditor/plugins/flash/swf/player.swf';
184184

185185
if (api_get_configuration_value('enable_uploadimage_editor')) {
186-
$config['imageUploadUrl'] = api_get_path(WEB_AJAX_PATH).'document.ajax.php?'.api_get_cidreq().'&a=ck_uploadimage&curdirpath=/';
186+
$config['imageUploadUrl'] = api_get_path(WEB_AJAX_PATH).'document.ajax.php?'.api_get_cidreq().'&a=ck_uploadimage';
187187
}
188188
/*filebrowserFlashBrowseUrl
189189
filebrowserFlashUploadUrl

0 commit comments

Comments
 (0)