Commit 4ebed9c0 authored by Chris Graham's avatar Chris Graham
Browse files

Security fix for MANTIS-4653 (Strip GPS EXIF data by default)

parent 020bf86d

cms/pages/modules/cms_galleries.php

+2 −2
Original line number Diff line number Diff line
@@ -1365,7 +1365,7 @@ class Module_cms_galleries extends Standard_crud_module 
        $maximum_dimension = intval(get_option('maximum_image_size'));

        $watermark = (post_param_integer('watermark', 0) == 1);

        $watermarks = $watermark ? find_gallery_watermarks($cat) : null;

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, $maximum_dimension, $watermarks);

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, $maximum_dimension, $watermarks, get_value('keep_gallery_gps', '0') == '0');



        $filename = '';

        $thumb_url = '';
@@ -1447,7 +1447,7 @@ class Module_cms_galleries extends Standard_crud_module 
        $maximum_dimension = intval(get_option('maximum_image_size'));

        $watermark = (post_param_integer('watermark', 0) == 1);

        $watermarks = $watermark ? find_gallery_watermarks($cat) : null;

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, $maximum_dimension, $watermarks);

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, $maximum_dimension, $watermarks, get_value('keep_gallery_gps', '0') == '0');



        if (!fractional_edit()) {

            $filename = '';

cms/pages/modules_custom/cms_iotds.php

+8 −0
Original line number Diff line number Diff line
@@ -304,10 +304,14 @@ class Module_cms_iotds extends Standard_crud_module 
     */

    public function add_actualisation()

    {

        require_code('uploads');

        $keep_gps = (get_value('keep_gallery_gps', '0') == '1');

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, null, null, !$keep_gps);

        require_code('themes2');

        $filename = '';

        $thumb_url = '';

        $url = post_param_image('image', 'uploads/iotds_addon', null, true, false, $filename, $thumb_url);

        reset_images_cleanup_pipeline_settings();



        $title = post_param_string('title');

        $caption = post_param_string('caption');
@@ -364,10 +368,14 @@ class Module_cms_iotds extends Standard_crud_module 


        check_edit_permission(($is_current == 1) ? 'high' : 'mid', $submitter);



        require_code('uploads');

        $keep_gps = (get_value('keep_gallery_gps', '0') == '1');

        set_images_cleanup_pipeline_settings(IMG_RECOMPRESS_LOSSLESS, null, null, !$keep_gps);

        require_code('themes2');

        $filename = '';

        $thumb_url = '';

        $url = post_param_image('image', 'uploads/iotds_addon', null, true, true, $filename, $thumb_url);

        reset_images_cleanup_pipeline_settings();



        $allow_rating = post_param_integer('allow_rating', 0);

        $allow_comments = post_param_integer('allow_comments', 0);

data_custom/functions.bin

+0 −0

File changed.

Preview suppressed by a .gitattributes entry or the file's encoding is unsupported.

View original file
View changed file

docs/pages/comcode_custom/EN/codebook_3.txt

+1 −0
Original line number Diff line number Diff line
@@ -630,6 +630,7 @@ We have the following which are either unlikely to be useful, or potentially uns 
  - [tt]search_do_days_fallback[/tt] -- set this to '0' if you don't want to re-search without a recency filter if no results were found

  - [tt]sitemap_orphans_to_pages[/tt] -- set this to '0' if you don't want orphaned pages to be put under the default Pages page grouping of the Sitemap

  - [tt]time_sensitive_rankings__<catalogue_name>[/tt] -- set this to a number for catalogue rating sorting to only consider this number of records. This is useful for a upvote/downvote system that is responsive to change in voting pattern. Requires the database to support window functions (MySQL 8+ does, Maria DB 10.2+ does).

  - [tt]keep_gallery_gps[/tt] -- set this to '1' if you want galleries (and related to feature) to not strip GPS metadata from images (which is done by default for privacy reasons)

 - Performance tuning (positive) [not official options as will break normal expectations of how the system will behave / complicate things]

  - [tt]slow_php_dns[/tt] -- set this to '1' if the server has very slow DNS resolution on the web server's main network interface, and therefore to do DNS resolution via the command line instead

  - [tt]lots_of_data_in_*[/tt] -- set this to '1', with '*' replaced with a database table name, if you want the Selectcode mechanism to work with recursive DB lookups rather than one huge flat lookup

docs/pages/comcode_custom/EN/tut_fields.txt

+4 −0
Original line number Diff line number Diff line
@@ -488,6 +488,8 @@ The first image-like field will be injected into screen metadata (i.e. will come 
| [tt]width[/tt] (the width all the media will be shown at; default is to auto-detect for each individual file)



[tt]height[/tt] (the height all the media will be shown at; default is to auto-detect for each individual file)



[tt]keep_gps=on|off[/tt] (whether to keep GPS metadata in images, which is stripped by default for privacy reasons; default is off)

|-

! Back-end UI

| [media framed="1" wysiwyg_editable="1" thumb="0" width="600"]data_custom/images/docs/tut_fields/core_fields_backend__picture.png[/media]
@@ -512,6 +514,8 @@ The first image-like field will be injected into screen metadata (i.e. will come 
| [tt]width[/tt] (the width all the media will be shown at; default is to auto-detect for each individual file)



[tt]height[/tt] (the height all the media will be shown at; default is to auto-detect for each individual file)



[tt]keep_gps=on|off[/tt] (whether to keep GPS metadata in images, which is stripped by default for privacy reasons; default is off)

|-

! Back-end UI

| [media framed="1" wysiwyg_editable="1" thumb="0" width="600"]data_custom/images/docs/tut_fields/core_fields_backend__picture_multi.png[/media]