Validate file extensions for remote avatars in UserAvatarAction

diff --git a/wcfsetup/install/files/lib/data/user/avatar/UserAvatarAction.class.php b/wcfsetup/install/files/lib/data/user/avatar/UserAvatarAction.class.php
index 9c89b31702ba659408e33e3ecb9b3c2003a88241..31b71b54b0d8232181d8e52152e916e341c8eb40 100644 (file)
--- a/wcfsetup/install/files/lib/data/user/avatar/UserAvatarAction.class.php
+++ b/wcfsetup/install/files/lib/data/user/avatar/UserAvatarAction.class.php
@@ -188,24 +188,25 @@ class UserAvatarAction extends AbstractDatabaseObjectAction {
                        @unlink($filename);
                        return;
                }
+               
                $tmp = pathinfo($tmp['path']);
-               if (!isset($tmp['basename']) || !isset($tmp['extension'])) {
-                       if (!isset($tmp['basename'])) {
-                               $tmp['basename'] = basename($filename);
-                       }
-                       
-                       if (!isset($tmp['extension'])) {
-                               $imageData = @getimagesize($filename);
-                               if ($imageData !== false) {
-                                       $tmp['extension'] = ImageUtil::getExtensionByMimeType($imageData['mime']);
-                               }
-                       }
+               if (!isset($tmp['basename'])) {
+                       $tmp['basename'] = basename($filename);
+               }
+               
+               $imageData = @getimagesize($filename);
+               if ($imageData !== false) {
+                       $tmp['extension'] = ImageUtil::getExtensionByMimeType($imageData['mime']);
                        
-                       if (empty($tmp['extension'])) {
+                       if (!in_array($tmp['extension'], ['jpeg', 'jpg', 'png', 'gif'])) {
                                @unlink($filename);
                                return;
                        }
                }
+               else {
+                       @unlink($filename);
+                       return;
+               }
                
                $data = [
                        'avatarName' => $tmp['basename'],