groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-02-26 11:29:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use a cryptographically random suffix for attachment file names to make them harder guess
Some checks failed
Build assets artifact / Build assets artifact (push) Has been cancelled
Details
Docker Image Build / build (linux/amd64, amd64, ubuntu-latest) (push) Has been cancelled
Details
Docker Image Build / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Has been cancelled
Details
Docker Image Build / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Has been cancelled
Details
Docker Image Build (FrankenPHP) / build (linux/amd64, amd64, ubuntu-latest) (push) Has been cancelled
Details
Docker Image Build (FrankenPHP) / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Has been cancelled
Details
Docker Image Build (FrankenPHP) / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Has been cancelled
Details
Static analysis / Static analysis (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, mysql) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, mysql) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, mysql) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, mysql) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, postgres) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, postgres) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, postgres) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, postgres) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, sqlite) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, sqlite) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, sqlite) (push) Has been cancelled
Details
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, sqlite) (push) Has been cancelled
Details
Docker Image Build / merge (push) Has been cancelled
Details
Docker Image Build (FrankenPHP) / merge (push) Has been cancelled
Details

Browse source
This commit is contained in:
Jan Böhmer 2026-02-24 23:20:09 +01:00
parent 0c83fd4799
commit 1650ade338
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/Services/Attachments/AttachmentSubmitHandler.php
View file

@ -137,7 +137,10 @@ class AttachmentSubmitHandler
$attachment->getName() $attachment->getName()
); );
return $safeName.'-'.uniqid('', false).'.'.$extension; // Generate a 12-character URL-safe random string, which should avoid collisions and prevent from guessing file paths.
$random = str_replace(['+', '/', '='], ['0', '1', '2'], base64_encode(random_bytes(9)));
return $safeName.'-'.$random.'.'.$extension;
} }
/** /**