svragv/sakisafe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Now you can tell the shit which file extensions you can't upload

Browse source
This commit is contained in:
qorg11 2020-06-30 00:05:55 +02:00
parent 4f70a9db11
commit 430df19608
No known key found for this signature in database
GPG key ID: 343FC20A4ACA62B9
2 changed files with 31 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
http/upload.cgi
View file

@ -27,8 +27,9 @@ $size = $ENV{CONTENT_LENGTH};
# Configuration # Configuration
$MAX_SIZE = 1024*1024*10; # Change for your size our $MAX_SIZE = 1024*1024*10; # Change for your size
$MAX_SIZE_MB = $MAX_SIZE / 1024 / 1024; # Don't change this our $MAX_SIZE_MB = $MAX_SIZE / 1024 / 1024; # Don't change this
our @not_allowed_extensions = qw(sh out exe);
if($filename eq "") if($filename eq "")
{ {
@ -45,15 +46,32 @@ if($size > $MAX_SIZE)
my $extension = $filename; my $extension = $filename;
$extension =~ s/.*\.//; # tar.gz sucks with this $extension =~ s/.*\.//; # tar.gz sucks with this
# Generate random string
my @chars = ("A".."Z", "a".."z"); my @chars = ("A".."Z", "a".."z");
my $string; my $string;
$string .= $chars[rand @chars] for 1..8; $string .= $chars[rand @chars] for 1..8;
my $upload_filehandle = $q->upload("file"); my $upload_filehandle = $q->upload("file");
$filename = $string . "." . $extension; $filename = $string . "." . $extension;
my $allowed_extension = 1;
foreach(@not_allowed_extensions)
{
if($filename =~ /\.$_$/i)
{
$allowed_extension = 0;
last;
}
}
if($allowed_extension)
{
open(FILE,">$upload_dir/$filename"); open(FILE,">$upload_dir/$filename");
binmode(FILE); binmode(FILE);
while(<$upload_filehandle>) while(<$upload_filehandle>)
{ {
print FILE; print FILE;
@ -62,3 +80,8 @@ while(<$upload_filehandle>)
close FILE; close FILE;
print $ENV{HTTP_REFERER} . "$upload_dir$filename"; print $ENV{HTTP_REFERER} . "$upload_dir$filename";
}
else {
print "The file extension .$extension is not allowed in this instance.";
}

6
lainsafecli
View file

@ -20,6 +20,7 @@
use Getopt::Long; use Getopt::Long;
use LWP::UserAgent; use LWP::UserAgent;
use strict; use strict;
use warnings; use warnings;
# variables # variables
@ -113,4 +114,9 @@ $req = $ua->post($url_to_upload,
print $ASCII_ART if $DISPLAY_ASCII; print $ASCII_ART if $DISPLAY_ASCII;
if($req->{_content} =~ /instance/) # If someone knows how to do it another way, I'm all ears
{
print $req->{_content} . "\n";
exit;
}
print $DEFAULT_SERVER . "/" . $req->{_content} . "\n"; print $DEFAULT_SERVER . "/" . $req->{_content} . "\n";