浏览代码

Fixed problem when uploading images with spaces in the filename

pecesama 18 年前
父节点
当前提交
b1c0e4ca6e
共有 3 个文件被更改,包括 23 次插入6 次删除
  1. 3 3
      admin/index.php
  2. 17 3
      classes/functions.php
  3. 3 0
      uploads/index.php

+ 3 - 3
admin/index.php 查看文件

49
 				$_POST["url"] = $conf->urlGelato."/uploads/".$photoName;
49
 				$_POST["url"] = $conf->urlGelato."/uploads/".$photoName;
50
 			}
50
 			}
51
 			
51
 			
52
-			if ( move_uploaded_file( $_FILES['photo']['tmp_name'], "../uploads/".$_FILES['photo']['name'] ) ) {
53
-				$_POST["url"] = $conf->urlGelato."/uploads/".$_FILES['photo']['name'];
52
+			if ( move_uploaded_file( $_FILES['photo']['tmp_name'], "../uploads/".sanitizeName($_FILES['photo']['name']) ) ) {
53
+				$_POST["url"] = $conf->urlGelato."/uploads/".sanitizeName($_FILES['photo']['name']);
54
 			}
54
 			}
55
 			
55
 			
56
 			unset($_POST["photo"]);
56
 			unset($_POST["photo"]);
359
 									$template->cargarPlantilla($input, $output, "template_regular_post");
359
 									$template->cargarPlantilla($input, $output, "template_regular_post");
360
 									$template->mostrarPlantilla();
360
 									$template->mostrarPlantilla();
361
 									break;
361
 									break;
362
-								case "2":						
362
+								case "2":
363
 									$fileName = "../uploads/".getFileName($register["url"]);
363
 									$fileName = "../uploads/".getFileName($register["url"]);
364
 									
364
 									
365
 									$x = @getimagesize($fileName);						
365
 									$x = @getimagesize($fileName);						

+ 17 - 3
classes/functions.php 查看文件

82
 		}
82
 		}
83
 	}
83
 	}
84
 	
84
 	
85
-	function getFile($remoteFileName) {		
86
-		$fileName = "../uploads/".getFileName($remoteFileName);
85
+	function getFile($remoteFileName) {
86
+		$fileName = sanitizeName("../uploads/".$remoteFileName);
87
 		$str = _file_get_contents($remoteFileName);
87
 		$str = _file_get_contents($remoteFileName);
88
 		if (!$handle = fopen($fileName, 'w')) {
88
 		if (!$handle = fopen($fileName, 'w')) {
89
 			return false;
89
 			return false;
165
  		}
165
  		}
166
  		closedir($handle);
166
  		closedir($handle);
167
  		return $dirs;
167
  		return $dirs;
168
- 	}	
168
+ 	}
169
+
170
+	function sanitizeName($name) {
171
+		$name = preg_replace('/[\'"]/', '', $name);
172
+		$name = preg_replace('/[^a-zA-Z0-9]+/', '-', $name);
173
+		$name = trim($name, '-');
174
+		$name = strtolower($name);
175
+		//HACK: We need to rework the regular expression to allow the dot
176
+		$ext = substr($name, strlen($name)-3, strlen($name));
177
+		$body = substr($name, 0, strlen($name)-4);
178
+		
179
+		$name = $body.".".$ext;
180
+		
181
+		return $name;
182
+	}
169
 	
183
 	
170
 	function _file_get_contents($path) {
184
 	function _file_get_contents($path) {
171
 		// Modified function from: 
185
 		// Modified function from: 

+ 3 - 0
uploads/index.php 查看文件

1
+<?php
2
+// Silence is golden.
3
+?>