Block files exploiting IE's mime-sniffing 'feature'

2011-04-10 22:31:08 +10:00
parent 406d287cd1
commit c544ad9bb8
2 changed files with 11 additions and 0 deletions
--- a/post.php
+++ b/post.php
@@ -407,6 +407,13 @@
 				error($config['error']['maxsize']);
 			}
 			
+			// Check IE MIME type detection XSS exploit
+			$buffer = file_get_contents($post['file'], null, null, null, 255);
+			if(preg_match($config['ie_mime_type_detection'], $buffer)) {
+				undoImage($post);
+				error($config['error']['mime_exploit']);
+			}
+			
 			$post['filehash'] = $config['file_hash']($post['file']);
 			$post['filesize'] = filesize($post['file']);