archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bug 1908 fixed: protect the uploaded photo filename against SQL injection.

Browse source 
git-svn-id: http://piwigo.org/svn/branches/2.1@7489 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall 2010-10-29 22:53:00 +00:00
parent 542920d0f0
commit fe0d5b7547
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
admin/include/functions_upload.inc.php
View file

@ -103,7 +103,7 @@ function add_uploaded_file($source_filepath, $original_filename=null, $categorie
// database registration
$insert = array(
'file' => isset($original_filename) ? $original_filename : basename($file_path),
'file' => pwg_db_real_escape_string(isset($original_filename) ? $original_filename : basename($file_path)),
'date_available' => $dbnow,
'tn_ext' => 'jpg',
'path' => preg_replace('#^'.preg_quote(PHPWG_ROOT_PATH).'#', '', $file_path),