|
@@ 154-172 (lines=19) @@
|
| 151 |
|
} |
| 152 |
|
|
| 153 |
|
// Validate the media path and filename |
| 154 |
|
if (preg_match('/^https?:\/\//i', $text[0], $match)) { |
| 155 |
|
// External media needs no further validation |
| 156 |
|
$fileName = $filename; |
| 157 |
|
$folderName = ''; |
| 158 |
|
unset($_FILES['mediafile'], $_FILES['thumbnail']); |
| 159 |
|
} elseif (preg_match('/([\/\\\\<>])/', $filename, $match)) { |
| 160 |
|
// Local media files cannot contain certain special characters |
| 161 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to contain the character “%s”.', $match[1])); |
| 162 |
|
break; |
| 163 |
|
} elseif (preg_match('/(\.(php|pl|cgi|bash|sh|bat|exe|com|htm|html|shtml))$/i', $filename, $match)) { |
| 164 |
|
// Do not allow obvious script files. |
| 165 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to have the extension “%s”.', $match[1])); |
| 166 |
|
break; |
| 167 |
|
} elseif (!$filename) { |
| 168 |
|
FlashMessages::addMessage(I18N::translate('No media file was provided.')); |
| 169 |
|
break; |
| 170 |
|
} else { |
| 171 |
|
$fileName = $filename; |
| 172 |
|
} |
| 173 |
|
|
| 174 |
|
// Now copy the file to the correct location. |
| 175 |
|
if (!empty($_FILES['mediafile']['name'])) { |
|
@@ 288-306 (lines=19) @@
|
| 285 |
|
} |
| 286 |
|
|
| 287 |
|
// Validate the media path and filename |
| 288 |
|
if (preg_match('/^https?:\/\//i', $filename, $match)) { |
| 289 |
|
// External media needs no further validation |
| 290 |
|
$fileName = $filename; |
| 291 |
|
$folderName = ''; |
| 292 |
|
unset($_FILES['mediafile'], $_FILES['thumbnail']); |
| 293 |
|
} elseif (preg_match('/([\/\\\\<>])/', $filename, $match)) { |
| 294 |
|
// Local media files cannot contain certain special characters |
| 295 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to contain the character “%s”.', $match[1])); |
| 296 |
|
break; |
| 297 |
|
} elseif (preg_match('/(\.(php|pl|cgi|bash|sh|bat|exe|com|htm|html|shtml))$/i', $filename, $match)) { |
| 298 |
|
// Do not allow obvious script files. |
| 299 |
|
FlashMessages::addMessage(I18N::translate('Filenames are not allowed to have the extension “%s”.', $match[1])); |
| 300 |
|
break; |
| 301 |
|
} elseif (!$filename) { |
| 302 |
|
FlashMessages::addMessage(I18N::translate('No media file was provided.')); |
| 303 |
|
break; |
| 304 |
|
} else { |
| 305 |
|
$fileName = $filename; |
| 306 |
|
} |
| 307 |
|
|
| 308 |
|
$oldFilename = $media->getFilename(); |
| 309 |
|
$newFilename = $folderName . $fileName; |
fisharebest /
webtrees
