diff --git a/inc/config.php b/inc/config.php index e5c0b42e..40ea923a 100644 --- a/inc/config.php +++ b/inc/config.php @@ -51,6 +51,7 @@ define('ERR_INVALIDIMG','Invalid image.', true); define('ERR_FILESIZE', 'Maximum file size: %maxsz% bytes
Your file\'s size: %filesz% bytes', true); define('ERR_MAXSIZE', 'The file was too big.', true); + define('ERR_INVALIDZIP', 'Invalid archive!', true); // For resizing, max values define('THUMB_WIDTH', 200, true); diff --git a/post.php b/post.php index 1c875f40..e10f3b4e 100644 --- a/post.php +++ b/post.php @@ -121,6 +121,12 @@ if(!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file'])) error(ERROR_NOMOVE); if($post['zip']) { + // Validate ZIP file + if(is_resource($zip = zip_open($post['zip']))) + zip_close($zip); + else + error(ERR_INVALIDZIP); + $post['file'] = ZIP_IMAGE; $post['extension'] = strtolower(substr($post['file'], strrpos($post['file'], '.') + 1)); } @@ -191,7 +197,6 @@ if(in_array($extension, $allowed_ext)) { if (zip_entry_open($zip, $entry, 'r')) { - // Fake post $dump_post = Array( 'subject' => $post['subject'],