Upload library, clean_file_name function: Fix xss bug.
For example: If you clear this string "%%3f3f" according to the $bad array will fail. The result will be "%3f"
Because str_replace() replaces left to right.
Signed-off-by: xeptor <servetozkan@live.com>
diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php
index 96bb17e..86c9341 100644
--- a/system/libraries/Upload.php
+++ b/system/libraries/Upload.php
@@ -1005,6 +1005,13 @@
'%3d' // =
);
+ do
+ {
+ $old_filename = $filename;
+ $filename = str_replace($bad, '', $filename);
+ }
+ while ($old_filename !== $filename);
+
return stripslashes(str_replace($bad, '', $filename));
}