Profile pictures are now handled by the application to mitigate possible directory traversals

to other sub-directories of the static directory (Admins/Staff with the right to edit user
accounts were able to set a path like ../static/favicon.png for the profile picture - this
isn't a "i'm in, now i have root access and can hack your mom"-vulnerability, but better fix
it before it evolves to one. or a dragon. it's too late for this crap.)
This commit is contained in:
W13R 2022-11-02 21:55:36 +01:00
parent 86ea7c0000
commit 9f270c12b4
8 changed files with 34 additions and 4 deletions

View file

@ -1,28 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="16"
height="16"
viewBox="0 0 16 16"
version="1.1"
id="svg5"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">
<defs
id="defs2" />
<g
id="layer1">
<circle
style="fill:#808080;fill-opacity:1;stroke:#fffcfe;stroke-opacity:1"
id="path848"
cx="8"
cy="4.5"
r="2.5" />
<path
style="fill:#7f7f7f;fill-opacity:1;stroke:#fffcff;stroke-opacity:1"
id="path3433"
d="m -3,-13.499699 a 5,5 0 0 1 -2.5,4.3301274 5,5 0 0 1 -5,0 5,5 0 0 1 -2.5,-4.3301274 h 5 z"
transform="scale(-1)" />
</g>
</svg>

Before

Width:  |  Height:  |  Size: 740 B