From 945eb9ac25e8aa1be4586e9da1637c6e70966eae Mon Sep 17 00:00:00 2001 From: z Date: Mon, 6 Jul 2020 15:00:10 +0800 Subject: [PATCH] * finish task #7307. --- module/file/model.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/module/file/model.php b/module/file/model.php index 8ab9bec770..85dce0a284 100644 --- a/module/file/model.php +++ b/module/file/model.php @@ -205,13 +205,15 @@ class fileModel extends model $file['title'] = $purifier->purify($file['title']); $file['size'] = $_POST['size']; $file['tmpname'] = $tmp_name; - /* Fix for build uuid like '../../'. */ - $file['uuid'] = str_replace(array('.', '/', '\\'), '', $_POST['uuid']); + $file['uuid'] = $_POST['uuid']; $file['pathname'] = $this->setPathName(0, $file['extension']); $file['chunkpath'] = 'chunks' . DS .'f_' . $file['uuid'] . '.' . $file['extension'] . '.part'; $file['chunks'] = isset($_POST['chunks']) ? intval($_POST['chunks']) : 0; $file['chunk'] = isset($_POST['chunk']) ? intval($_POST['chunk']) : 0; + /* Fix for build uuid like '../../'. */ + if(!preg_match('/[a-z0-9_]/i', $file['uuid'])) return false; + if(stripos($this->config->file->allowed, ',' . $file['extension'] . ',') === false) { $file['pathname'] = $file['pathname'] . '.notAllowed';