|
@@ 147-165 (lines=19) @@
|
| 144 |
|
} |
| 145 |
|
|
| 146 |
|
// Validate the media path and filename |
| 147 |
|
if (preg_match('/^https?:\/\//i', $text[0], $match)) { |
| 148 |
|
// External media needs no further validation |
| 149 |
|
$fileName = $filename; |
| 150 |
|
$folderName = ''; |
| 151 |
|
unset($_FILES['mediafile'], $_FILES['thumbnail']); |
| 152 |
|
} elseif (preg_match('/([\/\\\\<>])/', $filename, $match)) { |
| 153 |
|
// Local media files cannot contain certain special characters |
| 154 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to contain the character “%s”.', $match[1])); |
| 155 |
|
break; |
| 156 |
|
} elseif (preg_match('/(\.(php|pl|cgi|bash|sh|bat|exe|com|htm|html|shtml))$/i', $filename, $match)) { |
| 157 |
|
// Do not allow obvious script files. |
| 158 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to have the extension “%s”.', $match[1])); |
| 159 |
|
break; |
| 160 |
|
} elseif (!$filename) { |
| 161 |
|
FlashMessages::addMessage(I18N::translate('No media file was provided.')); |
| 162 |
|
break; |
| 163 |
|
} else { |
| 164 |
|
$fileName = $filename; |
| 165 |
|
} |
| 166 |
|
|
| 167 |
|
// Now copy the file to the correct location. |
| 168 |
|
if (!empty($_FILES['mediafile']['name'])) { |
|
@@ 280-298 (lines=19) @@
|
| 277 |
|
} |
| 278 |
|
|
| 279 |
|
// Validate the media path and filename |
| 280 |
|
if (preg_match('/^https?:\/\//i', $filename, $match)) { |
| 281 |
|
// External media needs no further validation |
| 282 |
|
$fileName = $filename; |
| 283 |
|
$folderName = ''; |
| 284 |
|
unset($_FILES['mediafile'], $_FILES['thumbnail']); |
| 285 |
|
} elseif (preg_match('/([\/\\\\<>])/', $filename, $match)) { |
| 286 |
|
// Local media files cannot contain certain special characters |
| 287 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to contain the character “%s”.', $match[1])); |
| 288 |
|
break; |
| 289 |
|
} elseif (preg_match('/(\.(php|pl|cgi|bash|sh|bat|exe|com|htm|html|shtml))$/i', $filename, $match)) { |
| 290 |
|
// Do not allow obvious script files. |
| 291 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to have the extension “%s”.', $match[1])); |
| 292 |
|
break; |
| 293 |
|
} elseif (!$filename) { |
| 294 |
|
FlashMessages::addMessage(I18N::translate('No media file was provided.')); |
| 295 |
|
break; |
| 296 |
|
} else { |
| 297 |
|
$fileName = $filename; |
| 298 |
|
} |
| 299 |
|
|
| 300 |
|
$oldFilename = $media->getFilename(); |
| 301 |
|
$newFilename = $folderName . $fileName; |
fisharebest /
webtrees
