Skip to content
Snippets Groups Projects
  1. Dec 01, 2016
  2. Nov 29, 2016
  3. Nov 28, 2016
  4. Nov 26, 2016
  5. Nov 22, 2016
    • Benni Mack's avatar
      [SECURITY] Disallow invalid encoding in GeneralUtility::validPathStr · e8d9c8d1
      Benni Mack authored
      Directory names, which have an invalid UTF encoding,
      cause the preg_match() to return false.
      To avoid that the complete statement in GeneralUtility::validPathStr()
      returns true in this case, a strict comparison against 0 is added,
      so that we ensure that strings with invalid encodings are rejected
      by this API method.
      
      As a consequence UTF-16 encoded path names are rejected as well, if the
      system / file system does not support them.
      
      Resolves: #73453
      Releases: master, 8.4, 7.6, 6.2
      Security-Commit: c54aa56d18815aa1867ec54358ad419ea03ec205
      Security-Bulletins: TYPO3-CORE-SA-2016-023, 024
      Change-Id: Iedd6628050d8cdf2efe429bcd7b577f5a6d11805
      Reviewed-on: https://review.typo3.org/50744
      
      
      Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
      Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
      e8d9c8d1
  6. Nov 20, 2016
  7. Nov 18, 2016
  8. Nov 17, 2016
  9. Nov 16, 2016