Bug #3386

; in file name borks file extension detection

Details

Submitted	2005-02-05 19:57 UTC
From	liste at twilo dot de
Status	No Feedback
Package	HTTP_Upload
PHP Version	4.3.10
OS	SuSE 9.1
Roadmaps	(Not assigned)

Comments

[2005-02-05 19:57 UTC] liste at twilo dot de

Description:
------------
wenn man *.jpeg zulässt, aber *.jpg nicht zulässt, kann man Dateien hochladen, die z.B. wie folgt heissen "vm-0091;.jpg"

bei der Ausgabe von print_r($file->getProp()); steht dann folgendes
Array
(
[real] => vm-0091.jpeg
[name] => vm-0091.jpeg
[form_name] => userfile[0]
[ext] => jpeg
[tmp_name] => /tmp/phpNgZKFY
[size] => 18445
[type] => image/jpeg
[error] =>
)

Reproduce code:
---------------
$file->setValidExtensions(array('jpeg', 'gif', 'png'), 'accept');

Expected result:
----------------
vm-0091;.jpg sollte abgelehnt werden, da die Dateiendung nicht unter "$file->setValidExtensions(array('jpeg', 'gif', 'png'), 'accept');" angegeben wurde

[2005-02-05 19:58 UTC] liste at twilo dot de

test

[2005-02-06 12:50 UTC] liste at twilo dot de

> if you allow *.jpeg but not *.jpeg, you can upload filse like
"vm-0091;.jpg"

if you allow *.jpeg but not *.jpg, you can upload filse like
"vm-0091;.jpg"

BTW: do I see this correctly that this was originally reported by kay
at ct-gzsz dot de and then changed to liste at twilo dot de ?!
sorry, I hoped that I can change it