From 61ed2690449818b81cfc05bea5ce9d25aafbf36a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 1 Jun 2012 10:16:42 +0200 Subject: [PATCH] Fix: restore broken feature. File upload/delete was ko with linux and windows. Note also that strisplashes should never be used anywhere in the code, because strislashes is nor a HTML escape, nor a javascrip escape, nor a shell or PHP escape function. If stripslashes is used somewhere, this means there is a bug somewhere else. upload/delete using the standard feature (not fileupload) works correctly with that on linux/windows. --- htdocs/core/lib/files.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php index 9a9eaf382d7..3c56d87984b 100644 --- a/htdocs/core/lib/files.lib.php +++ b/htdocs/core/lib/files.lib.php @@ -498,7 +498,7 @@ function dol_unescapefile($filename) // Remove path information and dots around the filename, to prevent uploading // into different directories or replacing hidden system files. // Also remove control characters and spaces (\x00..\x20) around the filename: - return trim(basename(stripslashes($filename)), ".\x00..\x20"); + return trim(basename($filename), ".\x00..\x20"); } /**