lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: clear file name send by php

Browse Source
This commit is contained in:
Regis Houssin 2012-06-01 07:11:00 +02:00
parent 6c963fc591
commit e9994c683a
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/core/lib/files.lib.php
View File

@ -495,7 +495,10 @@ function dol_move($srcfile, $destfile, $newmask=0, $overwriteifexists=1)
*/ */
function dol_unescapefile($filename) function dol_unescapefile($filename)
{ {
return stripslashes($filename); // Remove path information and dots around the filename, to prevent uploading
// into different directories or replacing hidden system files.
// Also remove control characters and spaces (\x00..\x20) around the filename:
return trim(basename(stripslashes($filename)), ".\x00..\x20");
} }
/** /**