diff --git a/phpBB/adm/admin_attachments.php b/phpBB/adm/admin_attachments.php index 9719cd9b76..01e5ef59e5 100644 --- a/phpBB/adm/admin_attachments.php +++ b/phpBB/adm/admin_attachments.php @@ -1,23 +1,15 @@ lang[$l_title]); // Search Imagick diff --git a/phpBB/download.php b/phpBB/download.php index 4643a2869b..1bfa140db5 100644 --- a/phpBB/download.php +++ b/phpBB/download.php @@ -1,24 +1,15 @@ ', $attachment['comment']))); + $comment = htmlspecialchars(str_replace("\\'", "'", $comment)); $denied = FALSE; diff --git a/phpBB/includes/functions_posting.php b/phpBB/includes/functions_posting.php index f06da1e412..22ef3c66ff 100644 --- a/phpBB/includes/functions_posting.php +++ b/phpBB/includes/functions_posting.php @@ -1,23 +1,15 @@ attachment_data = (isset($_POST['attachment_data'])) ? $_POST['attachment_data'] : array(); - + + // Make sure we do not add slashes twice... + foreach ($message_parser->attachment_data as $pos => $var) + { + $message_parser->attachment_data[$pos]['comment'] = stripslashes($message_parser->attachment_data[$pos]['comment']); + } + if ($post_attachment && !$submit && !$refresh && !$preview && $mode == 'edit') { $sql = 'SELECT d.*