From f6abfa61c693b9b55937be0db0a54ca074349cc6 Mon Sep 17 00:00:00 2001 From: Savetheinternet Date: Fri, 5 Nov 2010 20:32:40 +1100 Subject: Added a check to verify if .ZIP files are infact archives. --- post.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index 1c875f40..e10f3b4e 100644 --- a/post.php +++ b/post.php @@ -121,6 +121,12 @@ if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error(ERROR_NOMOVE); if($post['zip']) { + // Validate ZIP file + if(is_resource($zip = zip_open($post['zip']))) + zip_close($zip); + else + error(ERR_INVALIDZIP); + $post['file'] = ZIP_IMAGE; $post['extension'] = strtolower(substr($post['file'], strrpos($post['file'], '.') + 1)); } @@ -191,7 +197,6 @@ if(in_array($extension, $allowed_ext)) { if (zip_entry_open($zip, $entry, 'r')) { - // Fake post $dump_post = Array( 'subject' => $post['subject'], -- cgit v1.3