mainSavannah Administration - Support: sr #109422, Temporary upload...

 
 

sr #109422: Temporary upload (/register/upload.php) can overwrite another user's file if filename is the same

Submitter:  Dom Walden <drw>
Submitted:  Mon 27 Nov 2017 08:36:16 PM UTC
   
 
Category:  Savannah trackers - bugs, tasks, etc. Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  GNU/Linux Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 07 Apr 2022 04:25:56 PM UTC, comment #1: 

Thank you, fixed.

Ineiev <ineiev>
Site Administrator
Mon 27 Nov 2017 08:36:16 PM UTC, original submission:  

Problem

Uploading a file via /register/upload.php will overwrite a file of the same name in $GLOBALS['sys_upload_dir'] (on mine /var/www/submissions_uploads/).

I have reproduced this on my system (details below) with two different users, each uploading a file with the same filename but different contents. I checked that the file's size and contents in /var/www/submissions_uploads/ had changed between the two uploads.

Potential Solutions

Checking online, PHP's move_uploaded_file() apparently will overwrite files. Perhaps check whether a file already exists of the same name, and change the name of the newly uploaded file (perhaps add a unique identifier). Inform the user of the changed filename (obviously).

My System and Savane Version

savane version: git commit af1d2bb2918e48bc1d8c5df244872566f9f81ec7 (Thu Sep 28 10:54:57 2017 +0000)

I am running savane in a docker (version 1.6.2) container on my Debian Jessie machine. The docker container is based on a Debian Jessie image. Otherwise, setup was taken from https://savannah.gnu.org/maintenance/RunningSavaneLocally/ (my MySQL server runs on another local docker container).

Dom Walden <drw>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by drw (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-07 ineiev StatusNone Done
        Assigned toNone ineiev
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code