File: 0003-CVE-2020-8035-dont-allow-to-view-images-inline.patch

package info (click to toggle)
php-horde 5.2.20%2Bdebian0-1%2Bdeb10u2
  • links: PTS, VCS
  • area: main
  • in suites: buster
  • size: 12,816 kB
  • sloc: php: 11,222; xml: 9,577; javascript: 5,563; sh: 92; makefile: 33; sql: 1
file content (28 lines) | stat: -rw-r--r-- 959 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
From 64127fe3c2b9843c9760218e59dae9731cc56bdf Mon Sep 17 00:00:00 2001
From: Jan Schneider <jan@horde.org>
Date: Mon, 20 Apr 2020 23:07:51 +0200
Subject: [PATCH] Don't allow to view images inline if opened directly.

This services is supposed to process and view images inside a web page.
---
 services/images/view.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/horde-5.2.20/services/images/view.php b/horde-5.2.20/services/images/view.php
index bc7da534..f5b0cb25 100644
--- a/horde-5.2.20/services/images/view.php
+++ b/horde-5.2.20/services/images/view.php
@@ -84,6 +84,7 @@
 
 /* Check if no editing action required and send the image to browser. */
 if (empty($action)) {
+    header('Content-Disposition: attachment');
     $image->display();
     exit;
 }
@@ -132,4 +133,5 @@
 /* Write out any changes to the temporary file. */
 file_put_contents($file_name, $image->raw());
 
+header('Content-Disposition: attachment');
 $image->display();