[CVE-2020-9309] Require MimeUploadValidator on userformis' File Uploa…

…d field
silverstripe · Jul 13, 2020 · d459c51 · d459c51
1 parent c0c4698
commit d459c51
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 2 deletions.
diff --git a/_config/mimevalidator.yml b/_config/mimevalidator.yml
@@ -0,0 +1,6 @@
+---
+Name: mimeuploadvalidator-userforms
+---
+SilverStripe\Core\Injector\Injector:
+  SilverStripe\Assets\Upload_Validator.userforms:
+    class: SilverStripe\MimeValidator\MimeUploadValidator
diff --git a/code/Model/EditableFormField/EditableFileField.php b/code/Model/EditableFormField/EditableFileField.php
@@ -4,10 +4,12 @@
 
 use SilverStripe\Assets\File;
 use SilverStripe\Assets\Folder;
+use SilverStripe\Assets\Upload_Validator;
 use SilverStripe\Core\Config\Config;
 use SilverStripe\Core\Convert;
 use SilverStripe\Forms\FieldList;
 use SilverStripe\Forms\FileField;
+use SilverStripe\Core\Injector\Injector;
 use SilverStripe\Forms\LiteralField;
 use SilverStripe\Forms\NumericField;
 use SilverStripe\Forms\TreeDropdownField;
@@ -192,11 +194,14 @@ public function validate()
         return $result;
     }
 
+
+
     public function getFormField()
     {
         $field = FileField::create($this->Name, $this->Title ?: false)
             ->setFieldHolderTemplate(EditableFormField::class . '_holder')
-            ->setTemplate(__CLASS__);
+            ->setTemplate(__CLASS__)
+            ->setValidator(Injector::inst()->get(Upload_Validator::class . '.userforms'));
 
         $field->setFieldHolderTemplate(EditableFormField::class . '_holder')
             ->setTemplate(__CLASS__);

diff --git a/composer.json b/composer.json
@@ -34,7 +34,8 @@
         "silverstripe/cms": "^4.6",
         "symbiote/silverstripe-gridfieldextensions": "^3.1",
         "silverstripe/segment-field": "^2.0",
-        "silverstripe/versioned": "^1.0"
+        "silverstripe/versioned": "^1.0",
+        "silverstripe/mimevalidator": "^2.0"
     },
     "require-dev": {
         "phpunit/phpunit": "^5.7",