5e3741d0e5
The original fix only whitelisted image_name at the point it's saved in edit-layout.pl, leaving the actual injection sink in create-pdf.pl unparameterized. This adds defense-in-depth by fixing the query itself, avoids a redundant duplicate call to get_all_image_names() (already fetched earlier in the script as $image_names), and logs rejected image_name values instead of silently discarding them so tampering attempts leave an audit trail. Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> |
||
|---|---|---|
| .. | ||
| create-pdf.pl | ||
| edit-batch.pl | ||
| edit-layout.pl | ||
| edit-profile.pl | ||
| edit-template.pl | ||
| home.pl | ||
| image-manage.pl | ||
| manage.pl | ||
| print.pl | ||