Merge pull request #2 from thenitai/thenitai-security-patch-1

Update downloadlogfile.cfm
OpenBD · Mar 18, 2019 · 1e878a1 · 1e878a1
2 parents 2dd68c9 + 3719775
commit 1e878a1
Showing 1 changed file with 10 additions and 4 deletions.
diff --git a/bluedragon/administrator/debugging/downloadlogfile.cfm b/bluedragon/administrator/debugging/downloadlogfile.cfm
@@ -20,7 +20,13 @@
     along with the Open BlueDragon Administrator.  If not, see 
     <http://www.gnu.org/licenses/>.
 --->
-<cfset fullPath = Application.debugging.getLogFilePath(url.logFile) />
-<cfset fullPath = "#fullPath#/#url.logFile#" />
-<cfheader name="Content-disposition" value="attachment;filename=#url.logFile#" />
-<cfcontent type="text/plain" file="#fullPath#" />
+<cfif listLast(url.logFile, "/") CONTAINS ".log">
+    <cfset fullPath = Application.debugging.getLogFilePath(url.logFile) />
+    <cfset fullPath = "#fullPath#/#url.logFile#" />
+    <cfheader name="Content-disposition" value="attachment;filename=#url.logFile#" />
+    <cfcontent type="text/plain" file="#fullPath#" />
+<cfelse>
+    <cfsavecontent variable="request.content">
+      <h2>Nothing here for you!</h2>
+    </cfsavecontent>
+</cfif>