mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 05:50:42 +02:00
Code Issues Releases Wiki Activity

[ticket/9764] Allow $config['mime_triggers'] to be an empty string.

Browse Source 
explode('|', '') and explode('|', NULL) both return array(0 => '') which can
cause filespec::check_content() to reject everything starting with a '<'
character in case $config['mime_triggers'] is an empty string or not set.

fileupload::set_disallowed_content() now filters out empty strings by calling
array_diff() on the passed array, so setting $config['mime_triggers'] to an
empty string will turn off mime checking completely.

On the other side we want to fail safe if $config['mime_triggers'] is not set
at all. To do this, the array fileupload::$disallowed_content now contains some
default strings to be filtered out.

PHPBB3-9764
This commit is contained in:
Andreas Fischer
2010-10-28 21:41:14 +02:00
parent 6ff403c9f8
commit ac26bb458f
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
phpBB/includes/functions_posting.php
View File

@@ -388,7 +388,7 @@ function upload_attachment($form_name, $forum_id, $local = false, $local_storage
include_once($phpbb_root_path . 'includes/functions_upload.' . $phpEx);
$upload = new fileupload();
if ($config['check_attachment_content'])
if ($config['check_attachment_content'] && isset($config['mime_triggers']))
{
$upload->set_disallowed_content(explode('|', $config['mime_triggers']));
}