Nemcio/Grav-Admin-Plugin
1
0
Fork 0
mirror of https://github.com/getgrav/grav-plugin-admin.git synced 2025-11-06 05:15:43 +01:00
Code Issues Packages Projects Releases Activity

fixes GHSA-85r3-mf4x-qp8f

Browse Source
This commit is contained in:
Andy Miller
2020-11-30 16:36:30 -07:00
parent 7639db95c1
commit 24e7d154f1
2 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -14,6 +14,7 @@
* Tightened checks when removing a media file [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c) * Tightened checks when removing a media file [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c)
* Removed unused parameter in file field [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c) * Removed unused parameter in file field [GHSA-945r-cjfm-642c](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-945r-cjfm-642c)
* Fixed backup download URL [GHSA-vrvq-2pxg-rw5r](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-vrvq-2pxg-rw5r) * Fixed backup download URL [GHSA-vrvq-2pxg-rw5r](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-vrvq-2pxg-rw5r)
* Fixed deleting backup [GHSA-85r3-mf4x-qp8f](https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-85r3-mf4x-qp8f)
# v1.9.17 # v1.9.17
## 10/07/2020 ## 10/07/2020

11
classes/admincontroller.php
View File

@@ -1372,7 +1372,6 @@ class AdminController extends AdminBaseController
*/ */
protected function taskBackupDelete() protected function taskBackupDelete()
{ {
$param_sep = $this->grav['config']->get('system.param_sep', ':');
if (!$this->authorizeTask('backup', ['admin.maintenance', 'admin.super'])) { if (!$this->authorizeTask('backup', ['admin.maintenance', 'admin.super'])) {
return false; return false;
} }
@@ -1380,13 +1379,11 @@ class AdminController extends AdminBaseController
$backup = $this->grav['uri']->param('backup', null); $backup = $this->grav['uri']->param('backup', null);
if (null !== $backup) { if (null !== $backup) {
$file = base64_decode(urldecode($backup)); $filename = basename(base64_decode(urldecode($backup)));
$backups_root_dir = $this->grav['locator']->findResource('backup://', true); $file = $this->grav['locator']->findResource("backup://{$filename}", true);
$backup_path = $backups_root_dir . '/' . $file; if ($file) {
unlink($file);
if (file_exists($backup_path)) {
unlink($backup_path);
$this->admin->json_response = [ $this->admin->json_response = [
'status' => 'success', 'status' => 'success',