From 85e3407559c3d3467619f6df41d0a13863bafec0 Mon Sep 17 00:00:00 2001 From: Regis Houssin Date: Wed, 30 May 2012 13:58:20 +0200 Subject: [PATCH] =?UTF-8?q?Fix:=20Unescape=20a=20file=20submitted=20by=20u?= =?UTF-8?q?pload.=20PHP=20escape=20char=20"=20(%22)=20and=20char=20'=20(%2?= =?UTF-8?q?7)=20into=20$FILES=20Before=3D=20Capture=20d\'=C3=A9cran.doc=20?= =?UTF-8?q?=20After=3D=20Capture=20d'=C3=A9cran.doc?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- htdocs/core/lib/files.lib.php | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/htdocs/core/lib/files.lib.php b/htdocs/core/lib/files.lib.php index 9a5b9627695..126824784c8 100644 --- a/htdocs/core/lib/files.lib.php +++ b/htdocs/core/lib/files.lib.php @@ -488,16 +488,14 @@ function dol_move($srcfile, $destfile, $newmask=0, $overwriteifexists=1) } /** - * Unescape a file submitted by upload. PHP escape char " and only char " into $FILES with %22 - * This is a bug because when file contains %22, it is not escape, so there is no way to retrieve original value. - * So best solution is to keep " as %22 into uploaded filename. + * Unescape a file submitted by upload. PHP escape char " (%22) and char ' (%27) into $FILES + * Before= Capture d\'écran.doc After= Capture d'écran.doc * * @param string $filename Filename */ function dol_unescapefile($filename) { - //return stripslashes($filename); // FIXME - return $filename; + return stripslashes($filename); } /**