mirror of
https://github.com/phpbb/phpbb.git
synced 2025-08-01 14:30:32 +02:00
Truncate the URI to the size of the database field before we check it to ensure that what is stored in the database is the same as that we checked
git-svn-id: file:///svn/phpbb/branches/phpBB-2_0_0@5501 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
@@ -100,6 +100,8 @@ function user_avatar_url($mode, &$error, &$error_msg, $avatar_filename)
|
||||
$avatar_filename = 'http://' . $avatar_filename;
|
||||
}
|
||||
|
||||
$avatar_filename = substr($avatar_filename, 0, 100);
|
||||
|
||||
if ( !preg_match("#^((ht|f)tp://)([^ \?&=\#\"\n\r\t<]*?(\.(jpg|jpeg|gif|png))$)#is", $avatar_filename) )
|
||||
{
|
||||
$error = true;
|
||||
|
Reference in New Issue
Block a user