makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-27 21:58:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'develop-ascraeus' into develop

Browse source 
* develop-ascraeus:
  [ticket/12211] Do not run attachment file names twice through htmlspecialchars
This commit is contained in:
Joas Schilling 2014-04-12 10:16:58 +02:00
commit 91a3a5910a
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
phpBB/includes/functions_upload.php
View file

@ -64,7 +64,7 @@ class filespec
$this->filename = $upload_ary['tmp_name'];
$this->filesize = $upload_ary['size'];
$name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name'];
$name = trim(utf8_htmlspecialchars(utf8_basename($name)));
$name = trim(utf8_basename($name));
$this->realname = $this->uploadname = $name;
$this->mimetype = $upload_ary['type'];

14
tests/upload/filespec_test.php
View file

@ -273,4 +273,18 @@ class phpbb_filespec_test extends phpbb_test_case
$phpEx = '';
}
/**
* @dataProvider clean_filename_variables
*/
public function test_uploadname($filename)
{
$type_cast_helper = new \phpbb\request\type_cast_helper();
$upload_name = '';
$type_cast_helper->set_var($upload_name, $filename, 'string', true, true);
$filespec = $this->get_filespec(array('name'=> $upload_name));
$this->assertSame(trim(utf8_basename(htmlspecialchars($filename))), $filespec->uploadname);
}
}