Skip to content

Commit 79bfbb4

Browse files
nicolaasuninicolaasuni
authored
Merge pull request #780 from tecnickcom/imgpath
Forbid access to parent folders in SVG images path.
2 parents 14ffa0e + c6bd9a9 commit 79bfbb4

File tree

8 files changed

+18
-11
lines changed

8 files changed

+18
-11
lines changed

‎CHANGELOG.TXT‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
6.8.1 (2025-01-26)
2+
- Check relative paths on SVG images.
3+
14
6.8.0 (2024-12-23)
25
- Requires PHP 7.1+ and curl extension.
36
- Escape error message.

‎LICENSE.TXT‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
published by the Free Software Foundation, either version 3 of the
88
License, or (at your option) any later version.
99

10-
2002-2024 Nicola Asuni - Tecnick.com LTD
10+
2002-2025 Nicola Asuni - Tecnick.com LTD
1111

1212
**********************************************************************
1313
**********************************************************************

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
* **category** Library
88
* **author** Nicola Asuni <[email protected]>
9-
* **copyright** 2002-2024 Nicola Asuni - Tecnick.com LTD
9+
* **copyright** 2002-2025 Nicola Asuni - Tecnick.com LTD
1010
* **license** http://www.gnu.org/copyleft/lesser.html GNU-LGPL v3 (see LICENSE.TXT)
1111
* **link** http://www.tcpdf.org
1212
* **source** https://github.com/tecnickcom/TCPDF

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.8.0
1+
6.8.1

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"barcodes"
1313
],
1414
"homepage": "http://www.tcpdf.org/",
15-
"version": "6.8.0",
15+
"version": "6.8.1",
1616
"license": "LGPL-3.0-or-later",
1717
"authors": [
1818
{

‎include/tcpdf_fonts.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - [email protected]
88
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
99
// -------------------------------------------------------------------
10-
// Copyright (C) 2008-2024 Nicola Asuni - Tecnick.com LTD
10+
// Copyright (C) 2008-2025 Nicola Asuni - Tecnick.com LTD
1111
//
1212
// This file is part of TCPDF software library.
1313
//

‎include/tcpdf_static.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - [email protected]
88
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
99
// -------------------------------------------------------------------
10-
// Copyright (C) 2002-2024 Nicola Asuni - Tecnick.com LTD
10+
// Copyright (C) 2002-2025 Nicola Asuni - Tecnick.com LTD
1111
//
1212
// This file is part of TCPDF software library.
1313
//
@@ -55,7 +55,7 @@ class TCPDF_STATIC {
5555
* Current TCPDF version.
5656
* @private static
5757
*/
58-
private static $tcpdf_version = '6.8.0';
58+
private static $tcpdf_version = '6.8.1';
5959

6060
/**
6161
* String alias for total number of pages.

‎tcpdf.php‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
<?php
22
//============================================================+
33
// File name : tcpdf.php
4-
// Version : 6.8.0
4+
// Version : 6.8.1
55
// Begin : 2002-08-03
66
// Last Update : 2024-12-23
77
// Author : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - [email protected]
88
// License : GNU-LGPL v3 (http://www.gnu.org/copyleft/lesser.html)
99
// -------------------------------------------------------------------
10-
// Copyright (C) 2002-2024 Nicola Asuni - Tecnick.com LTD
10+
// Copyright (C) 2002-2025 Nicola Asuni - Tecnick.com LTD
1111
//
1212
// This file is part of TCPDF software library.
1313
//
@@ -104,7 +104,7 @@
104104
* Tools to encode your unicode fonts are on fonts/utils directory.</p>
105105
* @package com.tecnick.tcpdf
106106
* @author Nicola Asuni
107-
* @version 6.8.0
107+
* @version 6.8.1
108108
*/
109109

110110
// TCPDF configuration
@@ -128,7 +128,7 @@
128128
* TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.<br>
129129
* @package com.tecnick.tcpdf
130130
* @brief PHP class for generating PDF documents without requiring external extensions.
131-
* @version 6.8.0
131+
* @version 6.8.1
132132
* @author Nicola Asuni - [email protected]
133133
* @IgnoreAnnotation("protected")
134134
* @IgnoreAnnotation("public")
@@ -24467,6 +24467,10 @@ protected function startSVGElementHandler($parser, $name, $attribs, $ctm=array()
2446724467
$img = '@'.base64_decode(substr($img, strlen($m[0])));
2446824468
} else {
2446924469
// fix image path
24470+
if (strpos($img, '../') !== false) {
24471+
// accessing parent folders is not allowed
24472+
break;
24473+
}
2447024474
if (!TCPDF_STATIC::empty_string($this->svgdir) AND (($img[0] == '.') OR (basename($img) == $img))) {
2447124475
// replace relative path with full server path
2447224476
$img = $this->svgdir.'/'.$img;

0 commit comments

Comments
 (0)