Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-136288

Profile picture is missing server side validation on the size

    Details

      Description

      As a preparation, please have Burp Suite installed as it will be required to reproduce this issue.

      The Community Edition is free and can be downloaded from here:
      https://portswigger.net/burp/communitydownload

      Steps to reproduce:

      1. Start up Liferay
      2. Open Burp Suite (Select Temporary project)
      3. Click on Proxy from the top navbar
      4. Click on Open Browser (And click on Intercept is On to turn it off)
      5. Log in as the administrator
      6. Go to Account settings
      7. Upload the attached image (notice how the image is 390Kb and the max file size is 300Kb)
      8. Go to Burp Suite and click on the Intercept is off button
      9. Click on Save
      10. Go back to Burp and find the following variable: _com_liferay_image_uploader_web_portlet_ImageUploaderPortlet_maxFileSize
      11. Set the size of it to 100307200
      12. Click on Forward in Burp
      13. Turn interception off
      14. Click save

      Expected behavior : The image is not accepted and uploaded as it is over the size limit
      Actual behavior : The image is uploaded and used

        Attachments

          Activity

            People

            Assignee:
            marcell.weller Marcell Weller
            Reporter:
            istvan.dezsi Istvan Dezsi
            Participants of an Issue:
            Recent user:
            Clarissa Velazquez
            Engineering Assignee:
            Istvan Dezsi
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Days since last comment:
              8 weeks, 4 days ago

                Packages

                Version Package
                7.1.X
                7.2.10 DXP FP15
                7.2.X
                7.3.X
                Master