sec(Documents) sanitize and limit folder name and description

tsolucio · Jun 2, 2023 · e87f77c · e87f77c
1 parent 5e87fbc
commit e87f77c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/Documents/SaveFolder.php b/modules/Documents/SaveFolder.php
@@ -15,8 +15,8 @@
 
 $local_log = LoggerManager::getLogger('index');
 $folderid = isset($_REQUEST['record']) ? vtlib_purify($_REQUEST['record']) : '';
-$foldername = utf8RawUrlDecode($_REQUEST['foldername']);
-$folderdesc = utf8RawUrlDecode($_REQUEST['folderdesc']);
+$foldername = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['foldername']))), 0, 20);
+$folderdesc = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['folderdesc']))), 0, 50);
 
 if (isset($_REQUEST['savemode']) && $_REQUEST['savemode'] == 'Save') {
 	if ($folderid == '') {