From ac26bb458f2a2ea60848921826c69bfe03e676db Mon Sep 17 00:00:00 2001 From: Andreas Fischer Date: Thu, 28 Oct 2010 21:41:14 +0200 Subject: [ticket/9764] Allow $config['mime_triggers'] to be an empty string. explode('|', '') and explode('|', NULL) both return array(0 => '') which can cause filespec::check_content() to reject everything starting with a '<' character in case $config['mime_triggers'] is an empty string or not set. fileupload::set_disallowed_content() now filters out empty strings by calling array_diff() on the passed array, so setting $config['mime_triggers'] to an empty string will turn off mime checking completely. On the other side we want to fail safe if $config['mime_triggers'] is not set at all. To do this, the array fileupload::$disallowed_content now contains some default strings to be filtered out. PHPBB3-9764 --- phpBB/includes/functions_posting.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/includes/functions_posting.php') diff --git a/phpBB/includes/functions_posting.php b/phpBB/includes/functions_posting.php index 6fd87db663..72331a73c6 100644 --- a/phpBB/includes/functions_posting.php +++ b/phpBB/includes/functions_posting.php @@ -388,7 +388,7 @@ function upload_attachment($form_name, $forum_id, $local = false, $local_storage include_once($phpbb_root_path . 'includes/functions_upload.' . $phpEx); $upload = new fileupload(); - if ($config['check_attachment_content']) + if ($config['check_attachment_content'] && isset($config['mime_triggers'])) { $upload->set_disallowed_content(explode('|', $config['mime_triggers'])); } -- cgit v1.2.1