From e54242b711e7cc955dc89a7966bfac9a02e40b7a Mon Sep 17 00:00:00 2001 From: lotodore Date: Sat, 13 Oct 2007 14:23:04 +0000 Subject: [PATCH] Fixed possible security problem if cache dir is modified. Only files with md5sum as file name will be considered by the avatar manager. --- src/core/common/avatarmanager.cpp | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/src/core/common/avatarmanager.cpp b/src/core/common/avatarmanager.cpp index 78eedf69..962ee94e 100644 --- a/src/core/common/avatarmanager.cpp +++ b/src/core/common/avatarmanager.cpp @@ -317,15 +317,11 @@ AvatarManager::InternalReadDirectory(const std::string &dir, AvatarMap &avatars) string md5sum(basename(i->path())); MD5Buf md5buf; string fileName(i->path().file_string()); - bool success = true; - if (!md5buf.FromString(md5sum)) + if (md5buf.FromString(md5sum)) { - // sigh. File name is not an md5 sum. Calculate on our own... - if (!CryptHelper::MD5Sum(fileName, md5buf)) - success = false; - } - if (success) + // Only consider files with md5sum as name. avatars.insert(AvatarMap::value_type(md5buf, fileName)); + } } ++i; }