diff options
| author | ctrlaltca@gmail.com <> | 2011-11-17 16:52:56 +0000 |
|---|---|---|
| committer | ctrlaltca@gmail.com <> | 2011-11-17 16:52:56 +0000 |
| commit | d840107832b1f59a9fc3b93ffb97ef976be1b83c (patch) | |
| tree | 58d0dc8ef1426fa10952d5e4bd59d758ed2da827 /framework/Web/UI/ActiveControls/TActiveFileUpload.php | |
| parent | 730c58f877a335203f2b5e73e084a3079cf33f75 (diff) | |
3-in-1 bugfix commit:
1) TErrorHandler: avoid an error when trying to hide the file path of a lambda function
2) TSecurityManager: avoid a race condition when first generating the encryptionkey or the validationkey
3) TActiveFileUpload: urlencode the base64'ed token since it can contain the "+" character (otherway it would be traslated to a space)
Diffstat (limited to 'framework/Web/UI/ActiveControls/TActiveFileUpload.php')
| -rwxr-xr-x | framework/Web/UI/ActiveControls/TActiveFileUpload.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/framework/Web/UI/ActiveControls/TActiveFileUpload.php b/framework/Web/UI/ActiveControls/TActiveFileUpload.php index 98a7f422..1a49c20d 100755 --- a/framework/Web/UI/ActiveControls/TActiveFileUpload.php +++ b/framework/Web/UI/ActiveControls/TActiveFileUpload.php @@ -233,7 +233,7 @@ EOS; if ($mgr = Prado::getApplication()->getSecurityManager()) { // this is a less secure method, file info can be still forged from client side, but only if attacker knows the secret application key - $token = base64_encode($mgr->encrypt(serialize($params))); + $token = urlencode(base64_encode($mgr->encrypt(serialize($params)))); } else throw new Exception('TActiveFileUpload needs either an application level cache or a security manager to work securely'); @@ -253,7 +253,7 @@ EOS; else if ($mgr = Prado::getApplication()->getSecurityManager()) { - $v = $mgr->decrypt(base64_decode($token)); + $v = $mgr->decrypt(base64_decode(urldecode($token))); $params = unserialize($v); } else |