Fix: restore broken feature. File upload/delete was ko with linux and
windows. Note also that strisplashes should never be used anywhere in the code, because strislashes is nor a HTML escape, nor a javascrip escape, nor a shell or PHP escape function. If stripslashes is used somewhere, this means there is a bug somewhere else. upload/delete using the standard feature (not fileupload) works correctly with that on linux/windows.
This commit is contained in:
parent
f11508a09e
commit
61ed269044
@ -498,7 +498,7 @@ function dol_unescapefile($filename)
|
||||
// Remove path information and dots around the filename, to prevent uploading
|
||||
// into different directories or replacing hidden system files.
|
||||
// Also remove control characters and spaces (\x00..\x20) around the filename:
|
||||
return trim(basename(stripslashes($filename)), ".\x00..\x20");
|
||||
return trim(basename($filename), ".\x00..\x20");
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Loading…
Reference in New Issue
Block a user