Changeset 4104

Timestamp:

02/29/08 11:57:09 (10 months ago)

Author:

jmathis

Message:

remove vulnerability and send header of image/png

Location:

branches/centreon-1.4.2.4/www/include/doc

Files:

• get_image.php (modified) (1 diff)
• index.php (modified) (1 diff)

branches/centreon-1.4.2.4/www/include/doc/get_image.php

@@ -15 +15 @@
 For information : contact@oreon-project.org
 */
+        
+        $img = filter_var($_GET["img"], FILTER_SANITIZE_SPECIAL_CHARS);
+        $img = filter_var($img, INPUT_GET);
 
-        $tab = split("/", $_GET["img"]);
-        foreach ($tab as $img){
-                $image = $img;
-        }
-        $img = fopen("../../../doc/".$_GET["lang"]."/images/".$image, "r");     
-        while ($line = fgets($img)){
-                print $line;
+        $lang = filter_var($_GET["lang"], FILTER_SANITIZE_SPECIAL_CHARS);
+        $lang = filter_var($lang, INPUT_GET);
+
+
+        $tab_images = split("/", $img);
+        foreach ($tab_images as $value)
+                $image = $value;
+        
+        header("Content-Type: image/png");
+        
+        if (file_exists("../../../doc/".$lang."/images/".$image)){
+                $img = fopen("../../../doc/".$lang."/images/".$image, "r");     
+                if (isset($img) && $img)
+                        while ($line = fgets($img))
+                                print $line;
         }
 ?>

branches/centreon-1.4.2.4/www/include/doc/index.php

@@ -40 +40 @@
                         $line = preg_replace("/\<strong\>/", "<strong style=\"padding-left:20px;\">", $line);
                         $line = preg_replace("/\<p\>/", "<p style=\"text-align:justify;padding-left:20px;padding-right:10px;padding-top:5px;padding-bottom:10px;\">", $line);
-                        $line = preg_replace("/\<img src\=\"images\//", "<img src=./include/doc/get_image.php?lang=".$oreon->user->get_lang()."&img=", $line);
+                        $line = preg_replace("/\<img src\=\"images\//", "<img src=\"./include/doc/get_image.php?lang=".$oreon->user->get_lang()."&img=", $line);
                         $line = preg_replace("/\<table border\=\"0\"/", "<table border=\"1\"", $line);
                         print $line;