groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-05-19 18:01:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use a cryptographically random suffix for attachment file names to make them harder guess

Browse source
This commit is contained in:
Jan Böhmer 2026-02-24 23:20:09 +01:00 • committed by Marc Kreidler
parent ca573c1106
commit b4ee5c9e8e
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/Services/Attachments/AttachmentSubmitHandler.php
View file

@ -137,7 +137,10 @@ class AttachmentSubmitHandler
$attachment->getName() $attachment->getName()
); );
return $safeName.'-'.uniqid('', false).'.'.$extension; // Generate a 12-character URL-safe random string, which should avoid collisions and prevent from guessing file paths.
$random = str_replace(['+', '/', '='], ['0', '1', '2'], base64_encode(random_bytes(9)));
return $safeName.'-'.$random.'.'.$extension;
} }
/** /**