diff --git a/class2.php b/class2.php index 0ce64c21d..f2982e027 100644 --- a/class2.php +++ b/class2.php @@ -1188,7 +1188,7 @@ if ($pref['anon_post'] ? define('ANON', true) : define('ANON', false)); if (empty($pref['newsposts']) ? define('ITEMVIEW', 15) : define('ITEMVIEW', $pref['newsposts'])); -if ($pref['antiflood1'] == 1) +if ($pref['antiflood1'] == 1 && !defined('FLOODPROTECT')) { define('FLOODPROTECT', TRUE); define('FLOODTIMEOUT', max(varset($pref['antiflood_timeout'], 10), 3)); diff --git a/e107_web/js/plupload/upload.php b/e107_web/js/plupload/upload.php index cedfff15d..7f7bb3f17 100644 --- a/e107_web/js/plupload/upload.php +++ b/e107_web/js/plupload/upload.php @@ -11,7 +11,9 @@ // HTTP headers for no cache etc - +$_E107['no_online'] = true; +define('e_MINIMAL', true); +define('FLOODPROTECT', false); require_once("../../../class2.php"); if(!ADMIN) @@ -44,6 +46,8 @@ $chunk = isset($_REQUEST["chunk"]) ? intval($_REQUEST["chunk"]) : 0; $chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 0; $fileName = isset($_REQUEST["name"]) ? $_REQUEST["name"] : ''; + + // Clean the fileName for security reasons $fileName = preg_replace('/[^\w\._]+/', '_', $fileName);