Changeset 7490

Timestamp:

10/30/10 00:53:26 (3 years ago)

Author:

plg

Message:

merge r7489 from branch 2.1 to trunk

bug 1908 fixed: protect the uploaded photo filename against SQL injection.

Files:

• trunk/admin/include/functions_upload.inc.php (modified) (1 diff)

trunk/admin/include/functions_upload.inc.php

@@ -104 +104 @@
   // database registration
   $insert = array(
-    'file' => isset($original_filename) ? $original_filename : basename($file_path),
+    'file' => pwg_db_real_escape_string(isset($original_filename) ? $original_filename : basename($file_path)),
     'date_available' => $dbnow,
     'tn_ext' => 'jpg',