deploy: 32e9fbc

FriendsOfREDAXO · Feb 8, 2025 · 4369909 · 4369909
1 parent 9089343
commit 4369909
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 9 deletions.
diff --git a/classes/rex-mediapool.html b/classes/rex-mediapool.html
@@ -316,9 +316,9 @@ <h4 class="phpdocumentor-element__name" id="method_getAllowedExtensions">
     <aside class="phpdocumentor-element-found-in">
     <abbr class="phpdocumentor-element-found-in__file" title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php"><a href="files/redaxo-main-redaxo-src-addons-mediapool-lib-mediapool.html"><abbr title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php">mediapool.php</abbr></a></abbr>
     :
-    <span class="phpdocumentor-element-found-in__line">167</span>
+    <span class="phpdocumentor-element-found-in__line">169</span>
 
-            <a href="classes/rex-mediapool.html#source-view.167" class="phpdocumentor-element-found-in__source" data-line="167" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
+            <a href="classes/rex-mediapool.html#source-view.169" class="phpdocumentor-element-found-in__source" data-line="169" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
     </aside>
 
         <p class="phpdocumentor-summary">Get allowed mediatype extensions given via media widget &quot;types&quot; param.</p>
@@ -369,9 +369,9 @@ <h4 class="phpdocumentor-element__name" id="method_getBlockedExtensions">
     <aside class="phpdocumentor-element-found-in">
     <abbr class="phpdocumentor-element-found-in__file" title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php"><a href="files/redaxo-main-redaxo-src-addons-mediapool-lib-mediapool.html"><abbr title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php">mediapool.php</abbr></a></abbr>
     :
-    <span class="phpdocumentor-element-found-in__line">189</span>
+    <span class="phpdocumentor-element-found-in__line">191</span>
 
-            <a href="classes/rex-mediapool.html#source-view.189" class="phpdocumentor-element-found-in__source" data-line="189" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
+            <a href="classes/rex-mediapool.html#source-view.191" class="phpdocumentor-element-found-in__source" data-line="191" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
     </aside>
 
         <p class="phpdocumentor-summary">Get global blocked mediatype extensions.</p>
@@ -464,9 +464,9 @@ <h4 class="phpdocumentor-element__name" id="method_isAllowedMimeType">
     <aside class="phpdocumentor-element-found-in">
     <abbr class="phpdocumentor-element-found-in__file" title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php"><a href="files/redaxo-main-redaxo-src-addons-mediapool-lib-mediapool.html"><abbr title="redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php">mediapool.php</abbr></a></abbr>
     :
-    <span class="phpdocumentor-element-found-in__line">141</span>
+    <span class="phpdocumentor-element-found-in__line">143</span>
 
-            <a href="classes/rex-mediapool.html#source-view.141" class="phpdocumentor-element-found-in__source" data-line="141" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
+            <a href="classes/rex-mediapool.html#source-view.143" class="phpdocumentor-element-found-in__source" data-line="143" data-modal="source-view" data-src="files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt"></a>
     </aside>
 
         <p class="phpdocumentor-summary">Checks file against optional property `allowed_mime_types`.</p>

diff --git a/files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt b/files/redaxo-main/redaxo/src/addons/mediapool/lib/mediapool.php.txt
@@ -122,7 +122,9 @@ final class rex_mediapool
         foreach ($blockedExtensions as $blockedExtension) {
             // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
             // -> some webspaces execute files named file.php.txt as php
-            if (str_contains($filename, '.' . $blockedExtension)) {
+            if (str_ends_with($filename, '.' . $blockedExtension) // Prüfe ob der String mit der verbotenen Endung endet
+                || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt) // prüfe ob es keine doppelte Endung der Form *.php.ext gibt
+            ) {
                 return false;
             }
         }

diff --git a/files/redaxo-main/redaxo/src/addons/metainfo/lib/table_manager.php.txt b/files/redaxo-main/redaxo/src/addons/metainfo/lib/table_manager.php.txt
@@ -60,7 +60,8 @@ class rex_metainfo_table_manager
             throw new InvalidArgumentException('Invalid column type "' . $type . '"');
         }
         /** @psalm-taint-escape sql */
-        $qry .= ' ' . $type;
+        $type = ' ' . $type;
+        $qry .= $type;
 
         if (0 != $length) {
             $qry .= '(' . (int) $length . ')';
@@ -103,7 +104,8 @@ class rex_metainfo_table_manager
             throw new InvalidArgumentException('Invalid column type "' . $type . '"');
         }
         /** @psalm-taint-escape sql */
-        $qry .= ' ' . $type;
+        $type = ' ' . $type;
+        $qry .= $type;
 
         if (0 != $length) {
             $qry .= '(' . (int) $length . ')';