Browse Source

[svn r21639] FS#2867 - The FCKEditor, the simple file manager: Adding Dokeos specific routines for sanitizing names of uploaded files (including transliteration to ASCII letters only).

Ivan Tcholakov 15 years ago
parent
commit
2713d09580

+ 1 - 1
main/inc/lib/fckeditor/editor/filemanager/connectors/php/commands.php

@@ -200,7 +200,7 @@ function FileUpload( $resourceType, $currentFolder, $sCommand )
 
 		// Get the uploaded file name.
 		$sFileName = $oFile['name'] ;
-		$sFileName = SanitizeFileName( $sFileName ) ;
+		$sFileName = SanitizeFileName( $sFileName, $oFile['type'] ) ;
 
 		$sOriginalFileName = $sFileName ;
 

+ 2 - 2
main/inc/lib/fckeditor/editor/filemanager/connectors/php/config.php

@@ -133,8 +133,8 @@ $Config['ChmodOnFolderCreate'] = $permissions_for_new_directories ;
 
 
 // Files
-$Config['AllowedExtensions']['File']			= array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ;
-$Config['DeniedExtensions']['File']				= array('php', 'php3', 'php4', 'php5', 'phtml', 'asp', 'aspx', 'ascx', 'jsp', 'cfm', 'cfc', 'pl', 'bat', 'exe', 'dll', 'reg', 'cgi') ;
+$Config['AllowedExtensions']['File']			= array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'html', 'htm', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xhtml', 'xls', 'xml', 'zip') ;
+$Config['DeniedExtensions']['File']				= array('php', 'php3', 'php4', 'php5', 'php6', 'phps', 'phtml', 'asp', 'aspx', 'ascx', 'jsp', 'cfm', 'cfc', 'pl', 'bat', 'exe', 'dll', 'reg', 'cgi') ;
 $Config['FileTypesPath']['File']				= $Config['UserFilesPath'] ;
 $Config['FileTypesAbsolutePath']['File']		= $Config['UserFilesAbsolutePath'] ;
 $Config['QuickUploadPath']['File']				= $Config['UserFilesPath'] ;

+ 13 - 3
main/inc/lib/fckeditor/editor/filemanager/connectors/php/io.php

@@ -282,18 +282,28 @@ function SanitizeFolderName( $sNewFolderName )
 }
 
 // Do a cleanup of the file name to avoid possible problems
-function SanitizeFileName( $sNewFileName )
+function SanitizeFileName( $sNewFileName, $sMimeType = null )
 {
 	global $Config ;
 
-	$sNewFileName = stripslashes( $sNewFileName ) ;
+	if ( empty( $sMimeType ) )
+	{
+		$sNewFileName = stripslashes( $sNewFileName ) ;
+	}
+	else
+	{
+		$sNewFileName = add_ext_on_mime( stripslashes( $sNewFileName ), $sMimeType );
+	}
 
 	// Replace dots in the name with underscores (only one dot can be there... security issue).
 	if ( $Config['ForceSingleExtension'] )
 		$sNewFileName = preg_replace( '/\\.(?![^.]*$)/', '_', $sNewFileName ) ;
 
 	// Remove \ / | : ? * " < >
-	$sNewFileName = preg_replace( '/\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[[:cntrl:]]/', '_', $sNewFileName ) ;
+	//$sNewFileName = preg_replace( '/\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[[:cntrl:]]/', '_', $sNewFileName ) ;
+	$sNewFileName = replace_dangerous_char( $sNewFileName, 'strict' ) ;
+
+	$sNewFileName = php2phps( $sNewFileName ) ;
 
 	return $sNewFileName ;
 }