cbc7086677
The original fix only whitelisted image_name at the point it's saved
in edit-layout.pl, leaving the actual injection sink in create-pdf.pl
unparameterized. This adds defense-in-depth by fixing the query itself,
avoids a redundant duplicate call to get_all_image_names() (already
fetched earlier in the script as $image_names), and logs rejected
image_name values instead of silently discarding them so tampering
attempts leave an audit trail.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| create-pdf.pl | ||
| edit-batch.pl | ||
| edit-layout.pl | ||
| edit-profile.pl | ||
| edit-template.pl | ||
| home.pl | ||
| image-manage.pl | ||
| manage.pl | ||
| print.pl | ||