Vulnerability: Stored Cross-site Scripting in showdoc ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.
Vulnerability ID: GHSA-3pg8-c473-w6rr
CWE: CWE-79
Severity score: 6.9
Project: https://github.com/star7th/showdoc
Published: 2022-03-16
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability
Commit author: star7th

Vulnerable version (before fix):
 public function deleteFile($file_id){ 	}  	//上传文件，返回url 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){ 		$uploadFile = $_files[$file_key] ;  		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){ 			return false; 		}  public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.mp4', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.json','.css', 			) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后） 		if(in_array( $ext , $allow_array ) ){

Fixed version (after fix):
 public function deleteFile($file_id){ 	}  	//上传文件，返回url 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){ 		$uploadFile = $_files[$file_key] ;  		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){ 			return false; 		}  public function isDangerFilename($filename){ 	public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.mp4','.mov','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso', 			'.pdf','.epub','.xps','.doc','.docx','.wps', 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv', 			'.cer','.ppt','.pub','.json','.css', 		) ;  		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后） 		if(in_array( $ext , $allow_array ) ){

Patch:
patch: @@ -54,10 +54,10 @@ public function deleteFile($file_id){
 	}
 
 	//上传文件，返回url
-	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
+	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
+		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
@@ -324,14 +324,12 @@ public function isDangerFilename($filename){
 	public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
-			'.mp3','.wav','.mp4',
-			'.mov','.webmv','.flac','.mkv',
+			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
-			'.pdf','.ofd','.swf','.epub','.xps',
-			'.doc','.docx','.wps',
+			'.pdf','.epub','.xps','.doc','.docx','.wps',
 			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
 			'.cer','.ppt','.pub','.json','.css',
-			) ;
+		) ;
 
 		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
 		if(in_array( $ext , $allow_array ) ){
path: server/Application/Api/Model/AttachmentModel.class.php