This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository
https://gitbox.apache.org/repos/asf/ofbiz-framework.gitThe following commit(s) were added to refs/heads/release18.12 by this push:
new a324669 Fixed: Secure the uploads (OFBIZ-12080)
a324669 is described below
commit a324669af01a0cab0a4c81156fefadd48eac3eff
Author: Jacques Le Roux <
[hidden email]>
AuthorDate: Fri Mar 26 19:13:07 2021 +0100
Fixed: Secure the uploads (OFBIZ-12080)
Fixes an issue reported by 赖涵 <
[hidden email]>: "Any file upload and delete
in latest Apache OFBiz"
It was a simple syntax error on my side
---
.../src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index ef82c82..9d13ff8 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -217,10 +217,10 @@ public class SecuredUpload {
Path filePath = Paths.get(fileName);
byte[] bytesFromFile = Files.readAllBytes(filePath);
ImageFormat imageFormat = Imaging.guessFormat(bytesFromFile);
- return imageFormat.equals(ImageFormats.PNG)
+ return (imageFormat.equals(ImageFormats.PNG)
|| imageFormat.equals(ImageFormats.GIF)
|| imageFormat.equals(ImageFormats.TIFF)
- || imageFormat.equals(ImageFormats.JPEG)
+ || imageFormat.equals(ImageFormats.JPEG))
&& imageMadeSafe(fileName);
}