From 4b49a3145871a8f36f8f24fb6142860f32c189a9 Mon Sep 17 00:00:00 2001
From: Julian Maurice <julian.maurice@biblibre.com>
Date: Wed, 18 Jul 2012 16:49:59 +0200
Subject: [PATCH] Bug 6874: Follow-up: fix filename encoding and sanitization

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
---
 C4/UploadedFiles.pm |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/C4/UploadedFiles.pm b/C4/UploadedFiles.pm
index 5ad5adc..a14b406 100644
--- a/C4/UploadedFiles.pm
+++ b/C4/UploadedFiles.pm
@@ -54,6 +54,7 @@ It is not related to C4::UploadedFile
 use Modern::Perl;
 use Digest::SHA;
 use Fcntl;
+use Encode;
 
 use C4::Context;
 
@@ -120,7 +121,8 @@ $cgi->upload('uploaded_file')->handle;
 sub UploadFile {
     my ($filename, $dir, $handle) = @_;
 
-    if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {
+    $filename = decode_utf8($filename);
+    if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {
         warn "Filename or dirname contains '..'. Aborting upload";
         return;
     }
-- 
1.7.2.5