WordPress.org

Make WordPress Core

Ticket #16189: check for double periods.diff

File check for double periods.diff, 1.0 KB (added by simonwheatley, 11 years ago)

Add a file upload test for more than one contiguous period

  • wp-admin/includes/file.php

     
    301301        $test_form = true;
    302302        $test_size = true;
    303303        $test_upload = true;
     304        $test_filename = true;
    304305
    305306        // If you override this, you must provide $ext and $type!!!!
    306307        $test_type = true;
     
    327328                return call_user_func($upload_error_handler, $file, $error_msg);
    328329        }
    329330
     331        // Ensure filenames don't contain more than one contiguous period character
     332        if ( $test_filename && stristr( $file['name'], '..' ) !== false )
     333                return call_user_func($upload_error_handler, $file, __( 'Please rename your file to avoid ".." within the file name.' ));
     334
    330335        // A properly uploaded file will pass this test. There should be no reason to override this one.
    331336        if ( $test_upload && ! @ is_uploaded_file( $file['tmp_name'] ) )
    332337                return call_user_func($upload_error_handler, $file, __( 'Specified file failed upload test.' ));