Fix cve-2023-24249

neohitokiri · web-flow · commit b9751edf91cd · 2023-12-08T03:01:34.000-05:00
Fix cve-2023-24249 (z-song/laravel-admin#5805)
diff --git a/src/Form/Field/Image.php b/src/Form/Field/Image.php
@@ -20,7 +20,7 @@ class Image extends File
      *
      * @var string
      */
-    protected $rules = 'image';
+    protected $rules = 'image|mimes:bmp,jpg,png,jpeg,gif,svg,webp';
 
     protected function setType($type = 'image')
     {

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,7 @@ class Image extends File`
`20`	`20`	`*`
`21`	`21`	`* @var string`
`22`	`22`	`*/`
`23`		`- protected $rules = 'image';`
	`23`	`+ protected $rules = 'image\|mimes:bmp,jpg,png,jpeg,gif,svg,webp';`
`24`	`24`
`25`	`25`	`protected function setType($type = 'image')`
`26`	`26`	`{`