Tickets :: Comment on [#7646] Driver 'file' fails to open files with '..' anywhere in name

* Your Email Address
* Spam protection	Enter the letters below: __.. .. ..__ . . (__ \| \|\|\/\|[ __\|__\| .__)\|__\|\| \|[_./\| \|
Comment	>> What about paths like file.pdf/../../../etc/passwd ? > > > > I tried that, and it's stripped out. Any filename that has / in it > (on my unix box, at least) will only use the portion after the last / > , as if you had run 'basename' against it. So in this case the file > is simply renamed 'passwd' in the current directory. > > > >> Much less importantly, ereg_* is deprecated and against Horde CS; > >> please use the pcre functions instead (although this particular case > >> doesn't even need a regex). > > > > I just used a regex 'cause it was the only way I knew for sure to > only check the beginning of the string. I'll submit another patch > later today that uses pcre instead.
Attachment
Watch this ticket