From be85d8aad3bf3483de9b8bc409337b7252e94059 Mon Sep 17 00:00:00 2001
From: Eliot Whalan <ewhal@pantsu.cat>
Date: Sun, 19 Jun 2016 20:38:56 +1000
Subject: Introduce mime type whitelist

---
 php/includes/settings.inc.php | 16 ++++++++++++++--
 php/upload.php                |  4 ++++
 2 files changed, 18 insertions(+), 2 deletions(-)

(limited to 'php')

diff --git a/php/includes/settings.inc.php b/php/includes/settings.inc.php
index 01a0f86..f8c78cb 100644
--- a/php/includes/settings.inc.php
+++ b/php/includes/settings.inc.php
@@ -81,13 +81,25 @@ define('POMF_FILES_LENGTH', 6);
  */
 define('POMF_URL', 'https://i.pantsu.cat/');
 
-
-/* *
+/**
  * Blocked mime types
  * @param string[] $FILTER_MIME blocked mime types
  */
 $FILTER_MIME = array("")
 
+/**
+ * Whitelisted mime types
+ * @param bool $WHIELIST to enable whitelist of mime types 
+ */
+
+define('WHITELSIST', false);
+
+/**
+ * Whitelisted mime types
+ * @param string[] $WHITELIST_MIME_MIME allowed mime types
+ */
+$WHITELIST_MIME = array("")
+
 /**
  * Double dot file extensions
  *
diff --git a/php/upload.php b/php/upload.php
index a189f87..7ea89ff 100644
--- a/php/upload.php
+++ b/php/upload.php
@@ -84,6 +84,10 @@ function uploadFile($file)
     if (!in_array(mime_content_type($file), $FILTER_MIME)) {
         throw new UploadException(UPLOAD_ERR_EXTENSION);
     }
+    if $WHITELIST == true {
+        if (!in_array(mime_content_type($file), $WHITELIST_MIME)) {
+            throw new UploadException(UPLOAD_ERR_EXTENSION);
+    }
 
 
     // Check if a file with the same hash and size (a file which is the same)
-- 
cgit v1.2.3