diff -ru FCKeditor_2.5-virgin/editor/filemanager/browser/default/frmupload.html FCKeditor_2.5-patched/editor/filemanager/browser/default/frmupload.html --- FCKeditor_2.5-virgin/editor/filemanager/browser/default/frmupload.html 2007-07-10 13:47:30.000000000 +0100 +++ FCKeditor_2.5-patched/editor/filemanager/browser/default/frmupload.html 2007-12-10 19:15:23.000000000 +0000 @@ -82,6 +82,9 @@ case 202 : alert( 'Invalid file' ) ; break ; + case 204 : + alert( 'Invalid filename - it did not match a required pattern' ) ; + break ; default : alert( 'Error on file upload. Error number: ' + errorNumber ) ; break ; diff -ru FCKeditor_2.5-virgin/editor/filemanager/connectors/php/commands.php FCKeditor_2.5-patched/editor/filemanager/connectors/php/commands.php --- FCKeditor_2.5-virgin/editor/filemanager/connectors/php/commands.php 2007-10-02 19:15:16.000000000 +0100 +++ FCKeditor_2.5-patched/editor/filemanager/connectors/php/commands.php 2007-12-10 19:09:57.000000000 +0000 @@ -205,6 +205,13 @@ while ( true ) { + # Check filename is valid against any regexp + $arRegexp = (isSet ($Config['Regexp']) && array_key_exists ($resourceType, $Config['Regexp']) ? $Config['Regexp'][$resourceType] : false); + if ($arRegexp && !ereg( $arRegexp, RemoveExtension( $sOriginalFileName ))) { + $sErrorNumber = '204'; + break; + } + $sFilePath = $sServerDir . $sFileName ; if ( is_file( $sFilePath ) ) diff -ru FCKeditor_2.5-virgin/editor/filemanager/connectors/php/config.php FCKeditor_2.5-patched/editor/filemanager/connectors/php/config.php --- FCKeditor_2.5-virgin/editor/filemanager/connectors/php/config.php 2007-11-21 17:46:48.000000000 +0000 +++ FCKeditor_2.5-patched/editor/filemanager/connectors/php/config.php 2007-12-10 19:23:50.000000000 +0000 @@ -111,6 +111,7 @@ $Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; $Config['DeniedExtensions']['File'] = array() ; +$Config['Regexp']['File'] = '' ; $Config['FileTypesPath']['File'] = $Config['UserFilesPath'] . 'file/' ; $Config['FileTypesAbsolutePath']['File']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'file/' ; $Config['QuickUploadPath']['File'] = $Config['UserFilesPath'] ; @@ -118,6 +119,7 @@ $Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ; $Config['DeniedExtensions']['Image'] = array() ; +$Config['Regexp']['Image'] = '' ; $Config['FileTypesPath']['Image'] = $Config['UserFilesPath'] . 'image/' ; $Config['FileTypesAbsolutePath']['Image']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'image/' ; $Config['QuickUploadPath']['Image'] = $Config['UserFilesPath'] ; @@ -125,6 +127,7 @@ $Config['AllowedExtensions']['Flash'] = array('swf','flv') ; $Config['DeniedExtensions']['Flash'] = array() ; +$Config['Regexp']['Flash'] = '' ; $Config['FileTypesPath']['Flash'] = $Config['UserFilesPath'] . 'flash/' ; $Config['FileTypesAbsolutePath']['Flash']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'flash/' ; $Config['QuickUploadPath']['Flash'] = $Config['UserFilesPath'] ; @@ -132,6 +135,7 @@ $Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ; $Config['DeniedExtensions']['Media'] = array() ; +$Config['Regexp']['Media'] = '' ; $Config['FileTypesPath']['Media'] = $Config['UserFilesPath'] . 'media/' ; $Config['FileTypesAbsolutePath']['Media']= ($Config['UserFilesAbsolutePath'] == '') ? '' : $Config['UserFilesAbsolutePath'].'media/' ; $Config['QuickUploadPath']['Media'] = $Config['UserFilesPath'] ; diff -ru FCKeditor_2.5-virgin/editor/filemanager/connectors/test.html FCKeditor_2.5-patched/editor/filemanager/connectors/test.html --- FCKeditor_2.5-virgin/editor/filemanager/connectors/test.html 2007-07-10 13:47:30.000000000 +0100 +++ FCKeditor_2.5-patched/editor/filemanager/connectors/test.html 2007-12-10 19:15:07.000000000 +0000 @@ -84,6 +84,9 @@ case 202 : alert( 'Invalid file' ) ; break ; + case 204 : + alert( 'Invalid filename - it did not match a required pattern' ) ; + break ; default : alert( 'Error on file upload. Error number: ' + errorNumber ) ; break ; diff -ru FCKeditor_2.5-virgin/editor/filemanager/connectors/uploadtest.html FCKeditor_2.5-patched/editor/filemanager/connectors/uploadtest.html --- FCKeditor_2.5-virgin/editor/filemanager/connectors/uploadtest.html 2007-08-31 16:08:32.000000000 +0100 +++ FCKeditor_2.5-patched/editor/filemanager/connectors/uploadtest.html 2007-12-10 19:15:13.000000000 +0000 @@ -73,6 +73,9 @@ case 203 : alert( "Security error. You probably don't have enough permissions to upload. Please check your server." ) ; break ; + case 204 : + alert( 'Invalid filename - it did not match a required pattern' ) ; + break ; default : alert( 'Error on file upload. Error number: ' + errorNumber ) ; break ;