Dan Brown 7224fbcc89 Added protections against path traversal in file system operations ... - Files within the storage/ path could be accessed via path traversal references in content, accessed upon HTML export. - This addresses this via two layers: - Scoped local flysystem filesystems down to the specific image & file folders since flysystem has built-in checking against the escaping of the root folder. - Added path normalization before enforcement of uploads/{images,file} prefix to prevent traversal at a path level. Thanks to @Haxatron via huntr.dev for discovery and reporting. Ref: https://huntr.dev/bounties/ac268a17-72b5-446f-a09a-9945ef58607a/		2021-10-08 17:47:14 +01:00
..
Attachment.php	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00
AttachmentService.php	Added protections against path traversal in file system operations	2021-10-08 17:47:14 +01:00
HttpFetcher.php	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00
Image.php	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00
ImageRepo.php	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00
ImageService.php	Added protections against path traversal in file system operations	2021-10-08 17:47:14 +01:00
UserAvatars.php	Apply fixes from StyleCI	2021-06-26 15:23:15 +00:00