From 5e0fb0c2dc95dd7f82c32cb3082004e003f9a5d4 Mon Sep 17 00:00:00 2001 From: Simon Zalar Date: Thu, 6 Aug 2015 22:23:10 +0200 Subject: [PATCH 1/2] fixed a critical security bug --- .gitignore | 1 + recordmp3.js | 3 --- upload.php | 3 ++- 3 files changed, 3 insertions(+), 4 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1bb916f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/recordings \ No newline at end of file diff --git a/recordmp3.js b/recordmp3.js index 509974a..5572436 100644 --- a/recordmp3.js +++ b/recordmp3.js @@ -178,9 +178,6 @@ var reader = new FileReader(); reader.onload = function(event){ var fd = new FormData(); - var mp3Name = encodeURIComponent('audio_recording_' + new Date().getTime() + '.mp3'); - console.log("mp3name = " + mp3Name); - fd.append('fname', mp3Name); fd.append('data', event.target.result); $.ajax({ type: 'POST', diff --git a/upload.php b/upload.php index f8d9fef..326c7ba 100644 --- a/upload.php +++ b/upload.php @@ -10,7 +10,8 @@ $decodedData = base64_decode($data); // print out the raw data, //echo ($decodedData); -$filename = urldecode($_POST['fname']); +$filename = 'audio_recording_' . date( 'Y-m-d-H-i-s' ) .'.php'; + // write the data out to the file $fp = fopen('recordings/'.$filename, 'wb'); fwrite($fp, $decodedData); From 6a439b878465025741ba6147d21b605d65ed78f4 Mon Sep 17 00:00:00 2001 From: Simon Zalar Date: Thu, 6 Aug 2015 22:34:37 +0200 Subject: [PATCH 2/2] Update upload.php --- upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upload.php b/upload.php index 326c7ba..f81398b 100644 --- a/upload.php +++ b/upload.php @@ -10,7 +10,7 @@ $decodedData = base64_decode($data); // print out the raw data, //echo ($decodedData); -$filename = 'audio_recording_' . date( 'Y-m-d-H-i-s' ) .'.php'; +$filename = 'audio_recording_' . date( 'Y-m-d-H-i-s' ) .'.mp3'; // write the data out to the file $fp = fopen('recordings/'.$filename, 'wb');