function _seckit_ie_mime in Security Kit 6

Sets txt as allowed/restricted extension.

It's necessary to remove txt from allowed extensions, because Upload module can be used to exploit IE MIME sniffer bug, which leads to HTML injection. More information is available at http://p0deje.blogspot.com/2010/05/exploiting-ie-mime-sniffer.html

1 call to _seckit_ie_mime()

_seckit_ie_mime_js in ./seckit.module

Sends menu callback for AHAH, executes necessary functionality.

File

./seckit.module, line 315

Allows administrators to improve security of the website.

Code

function _seckit_ie_mime() {

  // check extensions
  $result = _seckit_ie_mime_check();
  switch ($result) {
    case SECKIT_IE_MIME_INSECURE:
      $default_extensions = variable_get('upload_extensions_default', 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp');
      $safe_extensions = preg_replace(SECKIT_IE_MIME_REGEX, ' ', $default_extensions);
      variable_set('upload_extensions_default', trim($safe_extensions));

      // extensions for anonymous users
      $anonymous_extensions = variable_get('upload_extensions_1', 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp');
      $safe_extensions = preg_replace(SECKIT_IE_MIME_REGEX, ' ', $anonymous_extensions);
      variable_set('upload_extensions_1', trim($safe_extensions));

      // print message
      drupal_set_message(t('Security Kit successfully removed txt from allowed extensions.'));
      break;
    case SECKIT_IE_MIME_SECURE:
      $default_extensions = variable_get('upload_extensions_default', 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp');
      $unsafe_extensions = $default_extensions . ' txt';
      variable_set('upload_extensions_default', $unsafe_extensions);

      // extensions for anonymous users
      $anonymous_extensions = variable_get('upload_extensions_1', 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp');
      $unsafe_extensions = $anonymous_extensions . ' txt';
      variable_set('upload_extensions_1', $unsafe_extensions);

      // print message
      drupal_set_message(t('Security Kit added txt to allowed extensions. Remember: it may lead to HTML injection.'), 'warning');
      break;
    case SECKIT_IE_MIME_FAILED:
      drupal_set_message(t('Upload module is not enabled. No changes were made.'), 'error');
      break;
  }
}