Version 4.5.0

applications/cms/interface/developer/developer.php

@@ -10,7 +10,7 @@
  *
  */
 
-define('REPORT_EXCEPTIONS', TRUE);
+\define('REPORT_EXCEPTIONS', TRUE);
 require_once str_replace( 'applications/cms/interface/developer/developer.php', '', str_replace( '\\', '/', __FILE__ ) ) . 'init.php';
 \IPS\Dispatcher\External::i();
 

applications/cms/interface/external/external.php

@@ -10,7 +10,7 @@
  *
  */
 
-define('REPORT_EXCEPTIONS', TRUE);
+\define('REPORT_EXCEPTIONS', TRUE);
 require_once str_replace( 'applications/cms/interface/external/external.php', '', str_replace( '\\', '/', __FILE__ ) ) . 'init.php';
 \IPS\Dispatcher\External::i();
 
@@ -20,4 +20,10 @@ $block = \IPS\cms\Blocks\Block::display( $id );
 
 \IPS\Output::i()->jsFiles = array_merge( \IPS\Output::i()->jsFiles, \IPS\Output::i()->js( 'front_external.js', 'cms', 'front' ) );
 \IPS\Output::i()->globalControllers[] = 'cms.front.external.communication';
+
+if( isset( \IPS\Output::i()->httpHeaders['X-Frame-Options'] ) )
+{
+	unset( \IPS\Output::i()->httpHeaders['X-Frame-Options'] );
+}
+
 \IPS\Output::i()->sendOutput( \IPS\Theme::i()->getTemplate( 'global', 'core' )->blankTemplate( $block ), 200, 'text/html' );

applications/cms/interface/file/file.php

@@ -9,7 +9,7 @@
  * @since		27 May 2015
  */
 
-define('REPORT_EXCEPTIONS', TRUE);
+\define('REPORT_EXCEPTIONS', TRUE);
 require_once str_replace( 'applications/cms/interface/file/file.php', '', str_replace( '\\', '/', __FILE__ ) ) . 'init.php';
 \IPS\Dispatcher\External::i();
 
@@ -21,12 +21,13 @@ try
 	/* Set up autoloader for CMS */
 
 	/* Init */
-	$databaseId  = intval( \IPS\Request::i()->database );
+	$databaseId  = \intval( \IPS\Request::i()->database );
 	$database    = \IPS\cms\Databases::load( $databaseId );
-	$recordId    = intval( \IPS\Request::i()->record );
+	$recordId    = \intval( \IPS\Request::i()->record );
 	$fileName    = urldecode( \IPS\Request::i()->file );
 	$recordClass = '\IPS\cms\Records' . $databaseId;
-	
+	$realFileName = NULL;
+
 	try
 	{
 		$record = $recordClass::load( $recordId );
@@ -41,27 +42,36 @@ try
 		\IPS\Output::i()->error( 'no_module_permission', '2T279/2', 403, '' );
 	}
 
+	$realFileName = \IPS\Text\Encrypt::fromTag( \IPS\Request::i()->fileKey )->decrypt();
+
+	if ( ! $realFileName )
+	{
+		\IPS\Output::i()->error( 'no_module_permission', '2T279/4', 403, '' );
+	}
+
 	/* Get file and data */
 	try
 	{
-		$file = \IPS\File::get( 'cms_Records', $fileName );
+		$file = \IPS\File::get( 'cms_Records', $realFileName );
 	}
 	catch( \Exception $ex )
 	{
 		\IPS\Output::i()->error( 'no_module_permission', '2T279/3', 404, '' ); 
 	}
 		
-	$headers = array_merge( \IPS\Output::getCacheHeaders( time(), 360 ), array( "Content-Disposition" => \IPS\Output::getContentDisposition( 'attachment', $file->originalFilename ), "X-Content-Type-Options" => "nosniff" ) );
+	$headers = array_merge( \IPS\Output::getCacheHeaders( time(), 360 ), array( "Content-Disposition" => \IPS\Output::getContentDisposition( 'attachment', \IPS\Request::i()->file ), "X-Content-Type-Options" => "nosniff" ) );
 	
 	/* Send headers and print file */
 	\IPS\Output::i()->sendStatusCodeHeader( 200 );
-	\IPS\Output::i()->sendHeader( "Content-type: " . \IPS\File::getMimeType( $file->originalFilename ) . ";charset=UTF-8" );
+	\IPS\Output::i()->sendHeader( "Content-type: " . \IPS\File::getMimeType( \IPS\Request::i()->file ) . ";charset=UTF-8" );
 
 	foreach( $headers as $key => $header )
 	{
 		\IPS\Output::i()->sendHeader( $key . ': ' . $header );
 	}
 	\IPS\Output::i()->sendHeader( "Content-Length: " . $file->filesize() );
+	\IPS\Output::i()->sendHeader( "Content-Security-Policy: default-src 'none'; sandbox" );
+	\IPS\Output::i()->sendHeader( "X-Content-Security-Policy:  default-src 'none'; sandbox" );
 
 	$file->printFile();
 	exit;