@@ -, +, @@ sanitization --- C4/UploadedFiles.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/C4/UploadedFiles.pm +++ a/C4/UploadedFiles.pm @@ -54,6 +54,7 @@ It is not related to C4::UploadedFile use Modern::Perl; use Digest::SHA; use Fcntl; +use Encode; use C4::Context; @@ -120,7 +121,8 @@ $cgi->upload('uploaded_file')->handle; sub UploadFile { my ($filename, $dir, $handle) = @_; - if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) { + $filename = decode_utf8($filename); + if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) { warn "Filename or dirname contains '..'. Aborting upload"; return; } --