From 47faf88f14bd420163e29e3cd583e741e63ce929 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Wed, 30 Mar 2011 11:44:05 +0200 Subject: Check if submitted files are in GZIP format. This is quite hacky but this way we can ensure users get comprehensible error messages when trying to upload ".tar.xz" or ".tar.bz2" files. Signed-off-by: Lukas Fleischer --- web/html/pkgsubmit.php | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index edffbfa1..72ada9d2 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -26,18 +26,32 @@ if ($_COOKIE["AURSID"]): $error = __("Error - No file uploaded"); } + # Check whether the file is gzip'ed + if (!$error) { + $fh = fopen($_FILES['pfile']['tmp_name'], 'rb'); + fseek($fh, 0, SEEK_SET); + $magic = end(unpack('v', fread($fh, 2))); + + if ($magic != 0x8b1f) { + $error = __("Error - unsupported file format (please submit gzip'ed tarballs generated by makepkg(8) only)."); + } + } + # Check uncompressed file size (ZIP bomb protection) if (!$error && $MAX_FILESIZE_UNCOMPRESSED) { - $fh = fopen($_FILES['pfile']['tmp_name'], 'rb'); fseek($fh, -4, SEEK_END); $filesize_uncompressed = end(unpack('V', fread($fh, 4))); - fclose($fh); if ($filesize_uncompressed > $MAX_FILESIZE_UNCOMPRESSED) { $error = __("Error - uncompressed file size too large."); } } + # Close file handle before extracting stuff + if (is_resource($fh)) { + fclose($fh); + } + $uid = uid_from_sid($_COOKIE['AURSID']); if (!$error) { -- cgit v1.2.3-24-g4f1b