globaleaks/GLBackend — pull request #147 by evilaliv3 (2013-08-21 10:21:22+00:00)
Title: addressed issue https://github.com/globaleaks/GlobaLeaks/issues/300

addressed some bugs:

1) the upload based on a save & raname caused a bug that leads to the possibility (by me exploited) to upload a arbitrary file with an arbitrary name.
this has now been fixed by saving the file directly with the name controlled by GLBackend and not by the attacker. in addition the file saving routine has been moved to the latest stage of the upload handler in order to have the file loaded only if all has gone fine.

2) now the static handler takes care of validating files (simply by their extension) allowing only jpg, jpeg, png, gif