* Fix LFI exploit (Thanks jsifuentes)

GameConnect · Dec 7, 2014 · e526ead · e526ead
1 parent 83fa118
commit e526ead
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/web_upload/getdemo.php b/web_upload/getdemo.php
@@ -30,7 +30,9 @@
   die('Demo not found.');
 }
 
-if(!file_exists(SB_DEMOS . "/" . $demo['filename']))
+$demo['filename'] = basename($demo['filename']);
+
+if(!in_array($demo['filename'], scandir(SB_DEMOS)) || !file_exists(SB_DEMOS . "/" . $demo['filename']))
 {
   die('File not found.');
 }

diff --git a/web_upload/includes/sb-callback.php b/web_upload/includes/sb-callback.php
@@ -1759,7 +1759,7 @@ function AddBan($nickname, $type, $steam, $ip, $length, $dfile, $dname, $reason,
 									   $_SERVER['REMOTE_ADDR']));
 	$subid = $GLOBALS['db']->Insert_ID();
 
-	if($dname && $dfile)
+	if($dname && $dfile && preg_match('/^[a-z0-9]*$/i', $dfile))
 	{
 		$GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_demos(demid,demtype,filename,origname)
 						     VALUES(?,'B', ?, ?)", array((int)$subid, $dfile, $dname));