diff --git a/docroot/includes/file.inc b/docroot/includes/file.inc index 0ec69b7..86a84a5 100644 --- a/includes/file.inc +++ b/includes/file.inc @@ -1148,7 +1148,7 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) { // Remove any null bytes. See http://php.net/manual/security.filesystem.nullbytes.php $filename = str_replace(chr(0), '', $filename); - $whitelist = array_unique(explode(' ', trim($extensions))); + $whitelist = trim($extensions); // Split the filename up by periods. The first part becomes the basename // the last part the final extension. @@ -1161,8 +1161,14 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) { // of allowed extensions. foreach ($filename_parts as $filename_part) { $new_filename .= '.' . $filename_part; - if (!in_array($filename_part, $whitelist) && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) { - $new_filename .= '_'; + + // Create a file object with the filename_part + $file = new stdClass(); + $file->filename = '.' . $filename_part; + + // Check if filename_part is allowed according to file_validate_extensions() + if (file_validate_extensions($file, $whitelist) !== array() && preg_match("/^[a-zA-Z]{2,5}\d?$/", $filename_part)) { + $new_filename .= '_'; } } $filename = $new_filename . '.' . $final_extension;