Resolve "OER-Campus: File upload vulnerabilities"

Closes #3586 and #3587

Merge request studip/studip!2480

1 files changed, 9 insertions, 2 deletions

diff --git a/app/controllers/studip_controller.php b/app/controllers/studip_controller.php
index 1ddce67..7a4da54 100644
--- a/app/controllers/studip_controller.php
+++ b/app/controllers/studip_controller.php
@@ -504,8 +504,15 @@ abstract class StudipController extends Trails_Controller
         }
 
         if ($content_type === null) {
-            $finfo = finfo_open(FILEINFO_MIME_TYPE);
-            $content_type = finfo_file($finfo, $file);
+            $content_type = get_mime_type($filename ?: $file);
+        }
+
+        if (!in_array($content_type, get_mime_types())) {
+            $content_type = 'application/octet-stream';
+        }
+
+        if ($content_type === 'application/octet-stream') {
+            $content_disposition = 'attachment';
         }
 
         $this->set_content_type($content_type);