New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[6.x] File Upload Security fixes #64

Merged

duncanmcclean merged 3 commits into 3.x from file-upload-security

Feb 11, 2024

Owner

duncanmcclean commented Feb 11, 2024

This pull request makes some security-related fixes to the File Uploads feature.

Users will only be able to upload certain file extensions, rather than any old file extension.
- This replaces the previous fix in Prevent uploading .php files #60 which prevented just .php files
- Related PR in Statamic Core: [4.x] Only allow uploading certain file extensions statamic/cms#9037
SVG file uploads are now sanitized.
- Related PR in Statamic Core: [4.x] Sanitize SVG uploads statamic/cms#9365

duncanmcclean and others added 3 commits

February 11, 2024 23:33


          Only allow uploading certain file extensions

43bb34f

Copying the fix from statamic/cms#9037


          Sanitize SVG uploads

01f0a13


          Apply Code Style changes

1403c36

duncanmcclean merged commit a6ee6c4 into 3.x

duncanmcclean deleted the file-upload-security branch

February 11, 2024 23:58

github-actions bot commented Feb 12, 2024

Released as part of v3.2.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet