NP_Mediatocu v1.0.8.1 SP1 RC6

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/plugin@766 1ca29b6e-896d-4ea0-84a5-967f57386b96

diff --git a/trunk/NP_Mediatocu/mediatocu/media.php b/trunk/NP_Mediatocu/mediatocu/media.php
index 837a357..c185409 100644 (file)
--- a/trunk/NP_Mediatocu/mediatocu/media.php
+++ b/trunk/NP_Mediatocu/mediatocu/media.php
@@ -26,8 +26,8 @@
  *\r
  */\r
 \r
-/* 1.0.8.1SP1RC4 2008-12-22-18:30(JP) cacher   */\r
 /* 1.0.8.1SP1RC5 katsumi */\r
+/* 1.0.8.1SP1RC6 2008-12-25 cacher     */\r
 \r
 if (!defined('_MEDIA_PHP_DEFINED')) {\r
        define('_MEDIA_PHP_DEFINED', 1);\r
@@ -322,7 +322,7 @@ if (postVar('targetthumb')) {
                        T.Kosugi edit End\r
                        */\r
 //                     $msg1 = rename($mediapath . $_POST[targetfile], $mediapath . htmlspecialchars($_POST[newname]) );\r
-                       $msg1 = media_rename($mediapath, postVar('targetfile'), htmlspecialchars(postVar('newname')) );\r
+                       $msg1 = media_rename($mediapath, postVar('targetfile'), htmlspecialchars($newfilename) );\r
                        if (!$msg1) {\r
                                print htmlspecialchars(postVar('targetfile') . _MEDIA_PHP_10);\r
                        }\r
@@ -332,7 +332,7 @@ if (postVar('targetthumb')) {
                        //print "targetthumb=$mediapath$_POST[targetthumb]<BR />";\r
                        if ($exist) {\r
 //                             $thumbnewname = $Prefix_thumb . $_POST[newname];\r
-                               $thumbnewname = $Prefix_thumb . postVar('newname');\r
+                               $thumbnewname = $Prefix_thumb . $newfilename;\r
 //                             $msg2         = rename($mediapath . $_POST[targetthumb], $mediapath . $thumbnewname);\r
                                $msg2         = media_rename($mediapath, postVar('targetthumb'), $thumbnewname);\r
                                if (!$msg2) {\r
@@ -801,7 +801,7 @@ function media_choose()
                </select>\r
        <?php           } else {\r
        ?>\r
-               <input name="collection" type="hidden" value="<?php echo htmlspecialchars($currentCollection)?>" />\r
+               <input name="collection" type="hidden" value="<?php echo htmlspecialchars($currentCollection); ?>" />\r
        <?php           } // if sizeof\r
        ?>\r
          <br /><br />\r
@@ -887,6 +887,9 @@ function media_upload()
                $filename = strftime("%Y%m%d-", time()) . $filename;\r
        }\r
 \r
+       // Filename should not contain '/' or '\'.\r
+       if (preg_match('#(/|\\\\)#',$filename)) media_doError(_ERROR_DISALLOWED);\r
+\r
        $collection = media_requestVar('collection');\r
        $res        = MEDIA::addMediaObject($collection, $filetempname, $filename);\r
 \r