From 6b522c183b2ba3143eaa8db2f94bbcbc917ba25c Mon Sep 17 00:00:00 2001 From: Yannick Warnier Date: Wed, 26 Dec 2007 12:28:01 +0100 Subject: [PATCH] [svn r14073] Updated php2phps regexp to cope with the security flaw making possible interpretation of PHP scripts when uploaded with a *.php.* filename - see FS#2152 --- main/inc/lib/fileUpload.lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main/inc/lib/fileUpload.lib.php b/main/inc/lib/fileUpload.lib.php index 54ac9fa886..a7e752e0e6 100644 --- a/main/inc/lib/fileUpload.lib.php +++ b/main/inc/lib/fileUpload.lib.php @@ -106,7 +106,7 @@ function replace_dangerous_char($filename, $strict = 'loose') function php2phps ($fileName) { - $fileName = eregi_replace("\.(php.?|phtml)$", ".phps", $fileName); + $fileName = preg_replace('/\.(php.?|phtml.?)\..*$/', '.phps', $fileName); return $fileName; } @@ -1097,7 +1097,7 @@ function filter_extension(&$filename) { $extensions = split(';',strtolower(api_get_setting('upload_extensions_blacklist'))); $skip = api_get_setting('upload_extensions_skip'); - $ext = strrchr($filename, "."); + $ext = strrchr($filename, "."); $ext = substr($ext,1); if(empty($ext)){return 1;}//we're in blacklist mode, so accept empty extensions if(in_array(strtolower($ext),$extensions))