Peter M. Groen / knowledgetree

Commit ebb315aeb4b078341c5dc2751f2d8a9781d7c679

Authored by Megan Watson
1 parent 1c2cc1a7

KTS-2157 

"bulk upload does not validate that file is a zip file."
Fixed. Added a check on the file type.

Committed By: Megan Watson
Reviewed By: Conrad Vermeulen

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@7808 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 11 additions and 1 deletions
plugins/ktcore/folder/BulkUpload.php
  View file @ebb315a
... ... @@ -114,7 +114,16 @@ class KTBulkUploadFolderAction extends KTFolderAction {
114 114  
115 115 unset($aErrorOptions['message']);
116 116 $aFile = $this->oValidator->validateFile($_FILES['file'], $aErrorOptions);
117   -
  117 +
  118 + // Ensure file is a zip file
  119 + $sMime = $aFile['type'];
  120 + $pos = strpos($sMime, 'x-zip-compressed');
  121 + if($pos === false){
  122 + $this->addErrorMessage(_kt("Bulk Upload failed: File is not a zip file."));
  123 + controllerRedirect("browse", 'fFolderId=' . $this->oFolder->getID());
  124 + exit(0);
  125 + }
  126 +
118 127 $matches = array();
119 128 $aFields = array();
120 129 foreach ($_REQUEST as $k => $v) {
... ... @@ -132,6 +141,7 @@ class KTBulkUploadFolderAction extends KTFolderAction {
132 141 $bm =& new KTBulkImportManager($this->oFolder, $fs, $this->oUser, $aOptions);
133 142 $this->startTransaction();
134 143 $res = $bm->import();
  144 +
135 145 $aErrorOptions['message'] = _kt("Bulk Upload failed");
136 146 $this->oValidator->notError($res, $aErrorOptions);
137 147  
... ...