Ticket #10559: 10559.001.2.diff

trunk/wp-includes/functions.php

@@ -2023 +2023 @@
  * @uses apply_filters() Calls 'upload_dir' on returned array.
  *
  * @param string $time Optional. Time formatted in 'yyyy/mm'.
+ * @param string $time Optional. Sub-directory to put files in.
  * @return array See above for description.
  */
-function wp_upload_dir( $time = null ) {
+function wp_upload_dir( $time = null, $subdir = '' ) {
         $siteurl = get_option( 'siteurl' );
         $upload_path = get_option( 'upload_path' );
         $upload_path = trim($upload_path);
@@ -2052 +2053 @@
         $bdir = $dir;
         $burl = $url;
 
-        $subdir = '';
+        if ( empty($subdir) || strpos($subdir, '..') !== false ) {
+                $subdir = '';
+        } else {
+                $subdir = '/' . trim( $subdir, '/' );
+        }
         if ( get_option( 'uploads_use_yearmonth_folders' ) ) {
                 // Generate the yearly and monthly dirs
                 if ( !$time )
                         $time = current_time( 'mysql' );
                 $y = substr( $time, 0, 4 );
                 $m = substr( $time, 5, 2 );
-                $subdir = "/$y/$m";
+                $subdir .= "/$y/$m";
         }
 
         $dir .= $subdir;
@@ -3284 +3289 @@
                         $display = $zone['t_continent'];
                 } else {
                         // It's inside a continent group
-                        
+
                         // Continent optgroup
                         if ( !isset( $zonen[$key - 1] ) || $zonen[$key - 1]['continent'] !== $zone['continent'] ) {
                                 $label = ( 'Etc' === $zone['continent'] ) ? __( 'Manual offsets' ) : $zone['t_continent'];
                                 $structure[] = '<optgroup label="'. esc_attr( $label ) .'">';
                         }
-                        
+
                         // Add the city to the value
                         $value[] = $zone['city'];
                         if ( 'Etc' === $zone['continent'] ) {
@@ -3318 +3323 @@
                         $selected = 'selected="selected" ';
                 }
                 $structure[] = '<option ' . $selected . 'value="' . esc_attr( $value ) . '">' . esc_html( $display ) . "</option>";
-                
+
                 // Close continent optgroup
                 if ( !empty( $zone['city'] ) && ( !isset($zonen[$key + 1]) || (isset( $zonen[$key + 1] ) && $zonen[$key + 1]['continent'] !== $zone['continent']) ) ) {
                         $structure[] = '</optgroup>';
@@ -3340 +3345 @@
 
 /**
  * Permanently deletes posts, pages, attachments, and comments which have been in the trash for EMPTY_TRASH_DAYS.
- * 
+ *
  * @since 2.9.0
  *
  * @return void