sco/pokerth
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed possible security problem if cache dir is modified. Only files with md5sum as file name will be considered by the avatar manager.

Browse Source
This commit is contained in:
lotodore
2007-10-13 14:23:04 +00:00
parent f3a5579b61
commit e54242b711
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/common/avatarmanager.cpp
+3 -7
View File
@@ -317,15 +317,11 @@ AvatarManager::InternalReadDirectory(const std::string &dir, AvatarMap &avatars)
string md5sum(basename(i->path())); string md5sum(basename(i->path()));
MD5Buf md5buf; MD5Buf md5buf;
string fileName(i->path().file_string()); string fileName(i->path().file_string());
bool success = true; if (md5buf.FromString(md5sum))
if (!md5buf.FromString(md5sum))
{ {
// sigh. File name is not an md5 sum. Calculate on our own... // Only consider files with md5sum as name.
if (!CryptHelper::MD5Sum(fileName, md5buf))
success = false;
}
if (success)
avatars.insert(AvatarMap::value_type(md5buf, fileName)); avatars.insert(AvatarMap::value_type(md5buf, fileName));
}
} }
++i; ++i;
} }