lywsvip/server
1
0
Fork 0
mirror of https://github.com/gotify/server.git synced 2026-05-08 14:26:56 +08:00
Code Issues Packages Projects Releases Wiki Activity
700 Commits 19 Branches 69 Tags
plugin-v2-dev
Commit Graph

2 Commits

Author SHA1 Message Date
Jannis Mattheis
925fb7e2c9 Fix file upload XSS 
The application image file upload allowed authenticated users to upload
malious .html files. Opening such a file like

https://push.gotify.net/image/ViaxrjzNowdgL-xnEfVV-Ggv5.html

would allow the attacker to execute client side scripts.

The application image upload will now only allow the upload of files
with the following extensions: .gif, .png, .jpg and .jpeg.
 2022-12-28 20:13:35 +01:00
Jannis Mattheis
61d5fc59a7 Add UploadApplicationImage API 2018-03-31 18:44:49 +02:00