Skip to content

Commit 884d9b3

Browse files
committed
Security: Avoid dangerous file name when uploading a file by extra field
1 parent d7ead2f commit 884d9b3

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

main/inc/lib/extra_field_value.lib.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -334,14 +334,13 @@ public function saveFieldValues(
334334
break;
335335
}
336336

337-
$cleanedName = api_replace_dangerous_char($value['name']);
338-
$fileName = ExtraField::FIELD_TYPE_FILE."_{$params['item_id']}_$cleanedName";
339337
if (!file_exists($fileDir)) {
340338
mkdir($fileDir, $dirPermissions, true);
341339
}
342340

343341
if (!empty($value['tmp_name']) && isset($value['error']) && $value['error'] == 0) {
344342
$cleanedName = api_replace_dangerous_char($value['name']);
343+
$cleanedName = disable_dangerous_file($cleanedName);
345344
$fileName = ExtraField::FIELD_TYPE_FILE."_{$params['item_id']}_$cleanedName";
346345
moveUploadedFile($value, $fileDir.$fileName);
347346

0 commit comments

Comments
 (0)