WordPress.org
Get WordPress

Plugin Directory

Changeset 982618


Ignore:
Timestamp:
09/06/2014 01:59:47 AM (12 years ago)
Author:
lynton_reed
Message:

fix for reported vulnerability issue where authenticated users could manipulate the accept_file_types parameter to upload php files.

Location:
work-the-flow-file-upload/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • work-the-flow-file-upload/trunk/README.txt

    r954893 r982618  
    55Requires at least: 3.5.1
    66Tested up to: 3.9.1
    7 Stable tag: 2.3.1
     7Stable tag: 2.3.2
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    325325
    326326== Changelog ==
     327= 2.3.2 =
     328* Fix for accept_file_types vulnerability where malicious authenticated users could manipulate the allowed upload file types to upload files with .php extensions
     329
    327330= 2.3.1 =
    328331* Fix loading of new demo workflow bug.
    … …  
    457460
    458461== Upgrade Notice ==
     462= 2.3.2 =
     463* Fix for accept_file_types vulnerability where malicious authenticated users could manipulate the allowed upload file types to upload files with .php extensions
     464
    459465= 2.3.1 =
    460466* Fix loading of new demo workflow bug.

  • work-the-flow-file-upload/trunk/public/class-wtf-fu.php

    r954893 r982618  
    4444     * @var     string
    4545     */
    46     const VERSION = '2.3.1';
     46    const VERSION = '2.3.2';
    4747
    4848    /**

  • work-the-flow-file-upload/trunk/public/includes/class-wtf-fu-fileupload-shortcode.php

    r920619 r982618  
    146146                        $options[$k] = '/\.(' . $v . ')$/i';
    147147                    }
     148                    $options[$k] = preg_replace("/php/i", "", $options[$k]);
     149                    log_me(array($k => $options[$k]));
    148150                    break;
    149151                case 'max_number_of_files' :

  • work-the-flow-file-upload/trunk/work-the-flow-file-upload.php

    r954893 r982618  
    55 * Plugin URI:        http://wtf-fu.com
    66 * Description:       Front end Html5 File Upload and configurable Workflow steps. Multiple file drag and drop, gallery image display, file reordering and archiving.
    7  * Version:           2.3.1
     7 * Version:           2.3.2
    88 * Author:            Lynton Reed
    99 * Author URI:        http://wtf-fu.com
Note: See TracChangeset for help on using the changeset viewer.