Ticket #22813: 22813-ms-files.diff

wp-includes/ms-files.php

@@ -23 +23 @@
         die( '404 — File not found.' );
 }
 
-$file = rtrim( BLOGUPLOADDIR, '/' ) . '/' . str_replace( '..', '', $_GET[ 'file' ] );
+$file = rtrim( BLOGUPLOADDIR, '/' ) . '/' . str_replace( array( '..', ' ' ), array( '', '+' ), $_GET['file'] );
 if ( !is_file( $file ) ) {
         status_header( 404 );
         die( '404 — File not found.' );