From a54154958b9c79b2e3225f4eb680c0c798709c73 Mon Sep 17 00:00:00 2001 From: Julian Maurice Date: Wed, 18 Jul 2012 16:49:59 +0200 Subject: [PATCH] Bug 6874: Follow-up: fix filename encoding and sanitization Signed-off-by: Kyle M Hall Signed-off-by: Paul Poulain Signed-off-by: Jared Camins-Esakov --- C4/UploadedFiles.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/C4/UploadedFiles.pm b/C4/UploadedFiles.pm index 5ad5adc..a14b406 100644 --- a/C4/UploadedFiles.pm +++ b/C4/UploadedFiles.pm @@ -54,6 +54,7 @@ It is not related to C4::UploadedFile use Modern::Perl; use Digest::SHA; use Fcntl; +use Encode; use C4::Context; @@ -120,7 +121,8 @@ $cgi->upload('uploaded_file')->handle; sub UploadFile { my ($filename, $dir, $handle) = @_; - if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) { + $filename = decode_utf8($filename); + if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) { warn "Filename or dirname contains '..'. Aborting upload"; return; } -- 1.7.9.5