View | Details | Raw Unified | Return to bug 6874
Collapse All | Expand All

(-)a/C4/UploadedFiles.pm (-2 / +3 lines)
Lines 54-59 It is not related to C4::UploadedFile Link Here
54
use Modern::Perl;
54
use Modern::Perl;
55
use Digest::SHA;
55
use Digest::SHA;
56
use Fcntl;
56
use Fcntl;
57
use Encode;
57
58
58
use C4::Context;
59
use C4::Context;
59
60
Lines 120-126 $cgi->upload('uploaded_file')->handle; Link Here
120
sub UploadFile {
121
sub UploadFile {
121
    my ($filename, $dir, $handle) = @_;
122
    my ($filename, $dir, $handle) = @_;
122
123
123
    if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {
124
    $filename = decode_utf8($filename);
125
    if($filename =~ m#(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {
124
        warn "Filename or dirname contains '..'. Aborting upload";
126
        warn "Filename or dirname contains '..'. Aborting upload";
125
        return;
127
        return;
126
    }
128
    }
127
- 

Return to bug 6874