Added a return false if an image doesn't pass XSS cleaning to prevent file_get_contents from returning a NULL and passing through unscathed.
diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php
index 8ad6705..4a4a66f 100644
--- a/system/libraries/Upload.php
+++ b/system/libraries/Upload.php
@@ -850,6 +850,10 @@
{
return TRUE; // its an image, no "triggers" detected in the first 256 bytes, we're good
}
+ else
+ {
+ return FALSE;
+ }
}
if (($data = @file_get_contents($file)) === FALSE)
@@ -1099,4 +1103,4 @@
}
/* End of file Upload.php */
-/* Location: ./system/libraries/Upload.php */
\ No newline at end of file
+/* Location: ./system/libraries/Upload.php */