lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix rename file

Browse Source
This commit is contained in:
lmarcouiller 2021-05-06 09:46:54 +02:00
parent 020ad5aebe
commit d55309c847
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
htdocs/core/actions_linkedfiles.inc.php
View File

@ -176,8 +176,11 @@ if ($action == 'confirm_deletefile' && $confirm == 'yes') {
// We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because // We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because
// this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call). // this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call).
$filenameto = dol_string_nohtmltag($filenameto); $filenameto = dol_string_nohtmltag($filenameto);
if (preg_match('/__.*__/', $filenameto)) {
if ($filenamefrom != $filenameto) { $error++;
setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
}
if (!$error && $filenamefrom != $filenameto) {
// Security: // Security:
// Disallow file with some extensions. We rename them. // Disallow file with some extensions. We rename them.
// Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code. // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.