From da4aed67d3764c82a6f266fb311e107561bded74 Mon Sep 17 00:00:00 2001 From: Rossiani Wijaya Date: Fri, 22 Jan 2010 02:01:03 +0000 Subject: [PATCH] MDL-21300 - remove filename validation for invalid character. --- admin/uploadpicture.php | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/admin/uploadpicture.php b/admin/uploadpicture.php index 3bbb682dd68..4b6d4a4f60a 100644 --- a/admin/uploadpicture.php +++ b/admin/uploadpicture.php @@ -191,17 +191,11 @@ function process_directory ($dir, $userfield, $overwrite, &$results) { */ function process_file ($file, $userfield, $overwrite) { // Add additional checks on the filenames, as they are user - // controlled and we don't want to open any security holes. + // controlled and we don't want to open any security holes. $path_parts = pathinfo(cleardoubleslashes($file)); $basename = $path_parts['basename']; $extension = $path_parts['extension']; - if ($basename != clean_param($basename, PARAM_CLEANFILE)) { - // The original picture file name has invalid characters - notify(get_string('uploadpicture_invalidfilename', 'admin', - clean_param($basename, PARAM_CLEANHTML))); - return PIX_FILE_ERROR; - } - + // The picture file name (without extension) must match the // userfield attribute. $uservalue = substr($basename, 0,