Merge pull request #85 from silbinarywolf/fix-setacceptedfiles

fix(FileAttachmentField): Fix security issue where file extensions aren't validated on the server-side.
unclecheese · Jan 8, 2018 · f942bc8 · f942bc8
2 parents fb00c68 + 334dda1
commit f942bc8
Showing 1 changed file with 17 additions and 1 deletion.
diff --git a/code/FileAttachmentField.php b/code/FileAttachmentField.php
@@ -577,7 +577,23 @@ public function setAcceptedFiles($files = array ()) {
         if(is_array($files)) {
             $files = implode(',', $files);
         }
-        $this->settings['acceptedFiles'] = str_replace(' ', '', $files);
+        $files = str_replace(' ', '', $files);
+        $this->settings['acceptedFiles'] = $files;
+
+        // Update validator
+        $validator = $this->getValidator();
+        if ($validator) {
+            $fileExts = explode(',', $files);
+
+            $validatorExts = array();
+            foreach ($fileExts as $fileExt) {
+                if ($fileExt && isset($fileExt[0]) && $fileExt[0] === '.') {
+                    $fileExt = substr($fileExt, 1);
+                }
+                $validatorExts[] = $fileExt;
+            }
+            $validator->setAllowedExtensions($validatorExts);
+        }
 
         return $this;
     }