Attachment #11098 for bug #6874

View | Details | Raw Unified | Return to bug 6874
Collapse All | Expand All




use Modern::Perl;
use Digest::SHA;
use Fcntl;
use Encode;

use C4::Context;


sub UploadFile {
    my ($filename, $dir, $handle) = @_;

    $filename = decode_utf8($filename);
    if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {
        warn "Filename or dirname contains '..'. Aborting upload";
        return;
    }
- 

Return to bug 6874

Lines 54-59 It is not related to C4::UploadedFile Link Here

(-)a/C4/UploadedFiles.pm (-2 / +3 lines)
54	use Modern::Perl;	54	use Modern::Perl;
55	use Digest::SHA;	55	use Digest::SHA;
56	use Fcntl;	56	use Fcntl;
		57	use Encode;
57		58
58	use C4::Context;	59	use C4::Context;
59		60
Lines 120-126 $cgi->upload('uploaded_file')->handle; Link Here
120	sub UploadFile {	121	sub UploadFile {
121	my ($filename, $dir, $handle) = @_;	122	my ($filename, $dir, $handle) = @_;
122		123
123	if($filename =~ m#/(^\|/)\.\.(/\|$)# or $dir =~ m#(^\|/)\.\.(/\|$)#) {	124	$filename = decode_utf8($filename);
		125	if($filename =~ m#(^\|/)\.\.(/\|$)# or $dir =~ m#(^\|/)\.\.(/\|$)#) {
124	warn "Filename or dirname contains '..'. Aborting upload";	126	warn "Filename or dirname contains '..'. Aborting upload";
125	return;	127	return;
126	}	128	}
127	-