summaryrefslogtreecommitdiffstats
path: root/web
diff options
context:
space:
mode:
authorLukas Fleischer <archlinux@cryptocrack.de>2011-02-22 19:46:51 +0100
committerLukas Fleischer <archlinux@cryptocrack.de>2011-02-23 11:17:27 +0100
commit09d8128f99c2edc27dd81efc63e9b3c797603ca1 (patch)
treee2a29431b1eae9c469415d2f6b9757622c31ca7c /web
parentf961ffd9c7f2d3d51d3e3b060990a4fef9e56c1b (diff)
downloadaurweb-09d8128f99c2edc27dd81efc63e9b3c797603ca1.tar.xz
Protect users against ZIP bombs (fixes FS#22991).
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web')
-rw-r--r--web/html/pkgsubmit.php12
-rw-r--r--web/lib/config.inc.proto5
2 files changed, 17 insertions, 0 deletions
diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php
index df7c467..17e1967 100644
--- a/web/html/pkgsubmit.php
+++ b/web/html/pkgsubmit.php
@@ -26,6 +26,18 @@ if ($_COOKIE["AURSID"]):
$error = __("Error - No file uploaded");
}
+ # Check uncompressed file size (ZIP bomb protection)
+ if (!$error && $MAX_FILESIZE_UNCOMPRESSED) {
+ $fh = fopen($_FILES['pfile']['tmp_name'], 'rb');
+ fseek($fh, -4, SEEK_END);
+ $filesize_uncompressed = end(unpack('V', fread($fh, 4)));
+ fclose($fh);
+
+ if ($filesize_uncompressed > $MAX_FILESIZE_UNCOMPRESSED) {
+ $error = __("Error - uncompressed file size too large.");
+ }
+ }
+
$uid = uid_from_sid($_COOKIE['AURSID']);
if (!$error) {
diff --git a/web/lib/config.inc.proto b/web/lib/config.inc.proto
index bee6889..80a7e54 100644
--- a/web/lib/config.inc.proto
+++ b/web/lib/config.inc.proto
@@ -53,3 +53,8 @@ $LOGIN_TIMEOUT = 7200;
# Session timeout when using "Remember me" cookies
$PERSISTENT_COOKIE_TIMEOUT = 60 * 60 * 24 * 30;
+
+# Uncompressed file size limit for submitted tarballs (ZIP bomb protection) -
+# please ensure "upload_max_filesize" is additionally set to no more than 3M,
+# otherwise this check might be easy to bypass (FS#22991 for details)
+$MAX_FILESIZE_UNCOMPRESSED = 1024 * 1024 * 8;