Nemcio/Grav-Admin-Plugin
1
0
Fork 0
mirror of https://github.com/getgrav/grav-plugin-admin.git synced 2025-11-02 11:26:04 +01:00
Code Issues Packages Projects Releases Activity

fixes GHSA-85r3-mf4x-qp8f

Browse Source
This commit is contained in:
Andy Miller
2020-11-30 16:36:30 -07:00
parent 7639db95c1
commit 24e7d154f1
2 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -14,6 +14,7 @@
* Tightened checks when removing a media file [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c)
* Removed unused parameter in file field [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c)
* Fixed backup download URL [GHSA-vrvq-2pxg-rw5r](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-vrvq-2pxg-rw5r)
* Fixed deleting backup [GHSA-85r3-mf4x-qp8f](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-85r3-mf4x-qp8f)
# v1.9.17
## 10/07/2020

11
classes/admincontroller.php
View File

@@ -1372,7 +1372,6 @@ class AdminController extends AdminBaseController
*/
protected function taskBackupDelete()
{
$param_sep = $this->grav['config']->get('system.param_sep', ':');
if (!$this->authorizeTask('backup', ['admin.maintenance', 'admin.super'])) {
return false;
}
@@ -1380,13 +1379,11 @@ class AdminController extends AdminBaseController
$backup = $this->grav['uri']->param('backup', null);
if (null !== $backup) {
$file = base64_decode(urldecode($backup));
$backups_root_dir = $this->grav['locator']->findResource('backup://', true);
$filename = basename(base64_decode(urldecode($backup)));
$file = $this->grav['locator']->findResource("backup://{$filename}", true);
$backup_path = $backups_root_dir . '/' . $file;
if (file_exists($backup_path)) {
unlink($backup_path);
if ($file) {
unlink($file);
$this->admin->json_response = [
'status' => 'success',