lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '3.2' of ssh://git@github.com/Dolibarr/dolibarr.git into 3.2

Browse Source
This commit is contained in:
Laurent Destailleur 2012-06-01 09:28:49 +02:00
commit 52f270d623
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/core/lib/files.lib.php
View File

@ -486,16 +486,17 @@ function dol_move($srcfile, $destfile, $newmask=0, $overwriteifexists=1)
} }
/** /**
* Unescape a file submitted by upload. PHP escape char " and only char " into $FILES with %22 * Unescape a file submitted by upload. PHP escape char " (%22) and char ' (%27) into $FILES
* This is a bug because when file contains %22, it is not escape, so there is no way to retrieve original value. * Before= Capture d\'écran.doc After= Capture d'écran.doc
* So best solution is to keep " as %22 into uploaded filename.
* *
* @param string $filename Filename * @param string $filename Filename
*/ */
function dol_unescapefile($filename) function dol_unescapefile($filename)
{ {
//return stripslashes($filename); // FIXME // Remove path information and dots around the filename, to prevent uploading
return $filename; // into different directories or replacing hidden system files.
// Also remove control characters and spaces (\x00..\x20) around the filename:
return trim(basename(stripslashes($filename)), ".\x00..\x20");
} }
/** /**