From 23429b17b6993350877441f85470294fa3b73d68 Mon Sep 17 00:00:00 2001 From: Dmitri Popov Date: Tue, 5 Oct 2021 12:52:33 +0200 Subject: [PATCH] Fix vulnerabilities --- SECURITY.md | 9 +++++ index.php | 33 +++++++++------- upload.php | 106 ---------------------------------------------------- 3 files changed, 28 insertions(+), 120 deletions(-) create mode 100644 SECURITY.md delete mode 100644 upload.php diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..dec815c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,9 @@ +# Security Policy + +## Supported versions + +The code in the `main` branch supported with security updates. + +## Reporting a vulnerability + +Please report security issues and vulnerabilities to dmpop@linux.com diff --git a/index.php b/index.php index db9254d..c18e07d 100644 --- a/index.php +++ b/index.php @@ -96,9 +96,14 @@ function read_gps_location($file) // Check whether the required directories exist if (!file_exists($photo_dir) || !file_exists($photo_dir . 'tims')) { - mkdir($photo_dir, 0777, true); - mkdir($photo_dir . 'tims', 0777, true); - echo ('

Add photos to the photos directory, then refresh this page.

'); + echo ("

Directory doesn't exist

+
+
"); + exit; } // Get file info @@ -204,7 +209,7 @@ function read_gps_location($file) } if ($file_count < 1) { - echo ('

Add photos to the photos directory, then refresh this page.

'); + echo ("

Add photos to the photos directory, then refresh this page.

"); } if (!isset($_GET["all"])) { @@ -220,14 +225,14 @@ function read_gps_location($file) $file = $files[$i]; $tim = $photo_dir . 'tims/' . basename($file); $file_path = pathinfo($file); - echo '' . $file_path['filename'] . ''; + echo '' . $file_path['filename'] . ''; } } else { for ($i = $offset; $i < $max; $i++) { $file = $files[$i]; $tim = $photo_dir . 'tims/' . basename($file); $file_path = pathinfo($file); - echo '' . $file_path['filename'] . ''; + echo '' . $file_path['filename'] . ''; } } echo ""; @@ -242,16 +247,16 @@ function show_pagination($current_page, $last_page, $sub_photo_dir) { echo '
'; if ($current_page != 1 && isset($_GET["photo"]) == '') { - echo ' '; + echo ' '; } if ($current_page > 1 && isset($_GET["photo"]) == '') { - echo ' '; + echo ' '; } if ($current_page < $last_page && isset($_GET["photo"]) == '') { - echo ''; + echo ''; } if ($current_page != $last_page && isset($_GET["photo"]) == '') { - echo ' '; + echo ' '; } echo '
'; } @@ -282,21 +287,21 @@ function show_pagination($current_page, $last_page, $sub_photo_dir) // If there is only one photo in the album, show the home navigation link if ($file_count == 1) { - echo "
"; + echo "
"; } // Disable the Previous link if this is the FIRST photo elseif (empty($files[$key - 1])) { - echo "
"; + echo "
"; } // Disable the Next link if this is the LAST photo elseif (empty($files[$key + 1])) { - echo "
"; + echo "
"; } // Show all navigation links else { echo "
-
"; + "; } // Check whether the localized description file matching the browser language exists diff --git a/upload.php b/upload.php deleted file mode 100644 index d64ac28..0000000 --- a/upload.php +++ /dev/null @@ -1,106 +0,0 @@ - - - - - - - Upload - - - - - - - -
-
- -

Upload

-
- - - -
-
-
- - - \ No newline at end of file