? sites/default/settings.php
Index: includes/file.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/file.inc,v
retrieving revision 1.216
diff -u -p -r1.216 file.inc
--- includes/file.inc	26 Jun 2010 19:55:47 -0000	1.216
+++ includes/file.inc	30 Jun 2010 11:23:45 -0000
@@ -1098,12 +1098,6 @@ function file_space_used($uid = NULL, $s
  * @param $validators
  *   An optional, associative array of callback functions used to validate the
  *   file. See file_validate() for a full discussion of the array format.
- *   If no extension validator is provided it will default to a limited safe
- *   list of extensions which is as follows: "jpg jpeg gif png txt
- *   doc xls pdf ppt pps odt ods odp". To allow all extensions you must
- *   explicitly set the 'file_validate_extensions' validator to an empty array
- *   (Beware: this is not safe and should only be allowed for trusted users, if
- *   at all).
  * @param $destination
  *   A string containing the URI $source should be copied to.
  *   This must be a stream wrapper URI. If this value is omitted, Drupal's
@@ -1166,56 +1160,28 @@ function file_save_upload($source, $vali
       return FALSE;
   }
 
+  // Build the list of non-munged extensions.
+  // @todo: this should not be here. we need to figure out the right place.
+  $extensions = '';
+  foreach ($user->roles as $rid => $name) {
+    $extensions .= ' ' . variable_get("upload_extensions_$rid",
+    variable_get('upload_extensions_default', 'jpg jpeg gif png txt html doc xls pdf ppt pps odt ods odp'));
+  }
+
   // Begin building file object.
   $file = new stdClass();
   $file->uid      = $user->uid;
   $file->status   = 0;
-  $file->filename = trim(basename($_FILES['files']['name'][$source]), '.');
+  $file->filename = file_munge_filename(trim(basename($_FILES['files']['name'][$source]), '.'), $extensions);
   $file->uri      = $_FILES['files']['tmp_name'][$source];
   $file->filemime = file_get_mimetype($file->filename);
   $file->filesize = $_FILES['files']['size'][$source];
 
-  $extensions = '';
-  if (isset($validators['file_validate_extensions'])) {
-    if (isset($validators['file_validate_extensions'][0])) {
-      // Build the list of non-munged extensions if the caller provided them.
-      $extensions = $validators['file_validate_extensions'][0];
-    }
-    else {
-      // If 'file_validate_extensions' is set and the list is empty then the
-      // caller wants to allow any extension. In this case we have to remove the
-      // validator or else it will reject all extensions.
-      unset($validators['file_validate_extensions']);
-    }
-  }
-  else {
-    // No validator was provided, so add one using the default list.
-    // Build a default non-munged safe list for file_munge_filename().
-    $extensions = 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp';
-    $validators['file_validate_extensions'] = array();
-    $validators['file_validate_extensions'][0] = $extensions;
-  }
-
-  if (!empty($extensions)) {
-    // Munge the filename to protect against possible malicious extension hiding
-    // within an unknown file type (ie: filename.html.foo).
-    $file->filename = file_munge_filename($file->filename, $extensions);
-  }
-
-  // Rename potentially executable files, to help prevent exploits (i.e. will
-  // rename filename.php.foo and filename.php to filename.php.foo.txt and
-  // filename.php.txt, respectively). Don't rename if 'allow_insecure_uploads'
-  // evaluates to TRUE.
-  if (!variable_get('allow_insecure_uploads', 0) && preg_match('/\.(php|pl|py|cgi|asp|js)(\.|$)/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
+  // Rename potentially executable files, to help prevent exploits.
+  if (preg_match('/\.(php|pl|py|cgi|asp|js)$/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
     $file->filemime = 'text/plain';
     $file->uri .= '.txt';
     $file->filename .= '.txt';
-    // The .txt extension may not be in the allowed list of extensions. We have
-    // to add it here or else the file upload will fail.
-    if (!empty($extensions)) {
-      $validators['file_validate_extensions'][0] .= ' txt';
-      drupal_set_message(t('For security reasons, your upload has been renamed to %filename.', array('%filename' => $file->filename)));
-    }
   }
 
   // If the destination is not provided, use the temporary directory.
Index: modules/aggregator/aggregator.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/aggregator/aggregator.admin.inc,v
retrieving revision 1.54
diff -u -p -r1.54 aggregator.admin.inc
--- modules/aggregator/aggregator.admin.inc	26 Jun 2010 19:55:47 -0000	1.54
+++ modules/aggregator/aggregator.admin.inc	30 Jun 2010 11:23:46 -0000
@@ -300,8 +300,7 @@ function aggregator_form_opml_validate($
  */
 function aggregator_form_opml_submit($form, &$form_state) {
   $data = '';
-  $validators = array('file_validate_extensions' => array('opml xml'));
-  if ($file = file_save_upload('upload', $validators)) {
+  if ($file = file_save_upload('upload')) {
     $data = file_get_contents($file->uri);
   }
   else {
Index: modules/locale/locale.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/locale/locale.admin.inc,v
retrieving revision 1.16
diff -u -p -r1.16 locale.admin.inc
--- modules/locale/locale.admin.inc	26 Jun 2010 21:32:20 -0000	1.16
+++ modules/locale/locale.admin.inc	30 Jun 2010 11:23:46 -0000
@@ -980,9 +980,8 @@ function locale_translate_import_form($f
  * Process the locale import form submission.
  */
 function locale_translate_import_form_submit($form, &$form_state) {
-  $validators = array('file_validate_extensions' => array('po'));
   // Ensure we have the file uploaded
-  if ($file = file_save_upload('file', $validators)) {
+  if ($file = file_save_upload('file')) {
 
     // Add language, if not yet supported
     drupal_static_reset('language_list');
Index: modules/locale/locale.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/locale/locale.test,v
retrieving revision 1.73
diff -u -p -r1.73 locale.test
--- modules/locale/locale.test	26 Jun 2010 19:55:47 -0000	1.73
+++ modules/locale/locale.test	30 Jun 2010 11:23:46 -0000
@@ -758,7 +758,7 @@ class LocaleImportFunctionalTest extends
    *   Additional options to pass to the translation import form.
    */
   function importPoFile($contents, array $options = array()) {
-    $name = tempnam(file_directory_path('temporary'), "po_") . '.po';
+    $name = tempnam(file_directory_path('temporary'), "po_");
     file_put_contents($name, $contents);
     $options['files[file]'] = $name;
     $this->drupalPost('admin/config/regional/translate/import', $options, t('Import'));
@@ -905,7 +905,7 @@ class LocaleExportFunctionalTest extends
   function testExportTranslation() {
     // First import some known translations.
     // This will also automatically enable the 'fr' language.
-    $name = tempnam(file_directory_path('temporary'), "po_") . '.po';
+    $name = tempnam(file_directory_path('temporary'), "po_");
     file_put_contents($name, $this->getPoFile());
     $this->drupalPost('admin/config/regional/translate/import', array(
       'langcode' => 'fr',
Index: modules/simpletest/tests/file.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/file.test,v
retrieving revision 1.57
diff -u -p -r1.57 file.test
--- modules/simpletest/tests/file.test	26 Jun 2010 19:55:47 -0000	1.57
+++ modules/simpletest/tests/file.test	30 Jun 2010 11:23:46 -0000
@@ -537,17 +537,12 @@ class FileSaveUploadTest extends FileHoo
   /**
    * An image file path for uploading.
    */
-  protected $image;
-
-  /**
-   * A PHP file path for upload security testing.
-   */
-  protected $phpfile;
+  var $image;
 
   /**
    * The largest file id when the test starts.
    */
-  protected $maxFidBefore;
+  var $maxFidBefore;
 
   public static function getInfo() {
     return array(
@@ -563,17 +558,14 @@ class FileSaveUploadTest extends FileHoo
     $this->drupalLogin($account);
 
     $this->image = current($this->drupalGetTestFiles('image'));
-    $this->assertTrue(is_file($this->image->uri), t("The image file we're going to upload exists."));
-
-    $this->phpfile = current($this->drupalGetTestFiles('php'));
-    $this->assertTrue(is_file($this->phpfile->uri), t("The PHP file we're going to upload exists."));
+    $this->assertTrue(is_file($this->image->uri), t("The file we're going to upload exists."));
 
     $this->maxFidBefore = db_query('SELECT MAX(fid) AS fid FROM {file_managed}')->fetchField();
 
-    // Upload with replace to guarantee there's something there.
+    // Upload with replace to gurantee there's something there.
     $edit = array(
       'file_test_replace' => FILE_EXISTS_REPLACE,
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
+      'files[file_test_upload]' => drupal_realpath($this->image->uri)
     );
     $this->drupalPost('file-test/upload', $edit, t('Submit'));
     $this->assertResponse(200, t('Received a 200 response for posted test file.'));
@@ -639,158 +631,6 @@ class FileSaveUploadTest extends FileHoo
   }
 
   /**
-   * Test extension handling.
-   */
-  function testHandleExtension() {
-    // The file being tested is a .gif which is in the default safe list
-    // of extensions to allow when the extension validator isn't used. This is
-    // implicitly tested at the testNormal() test. Here we tell
-    // file_save_upload() to only allow ".foo".
-    $extensions = 'foo';
-    $edit = array(
-      'file_test_replace' => FILE_EXISTS_REPLACE,
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
-      'extensions' => $extensions,
-    );
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $message = t('Only files with the following extensions are allowed: ') . '<em class="placeholder">' . $extensions . '</em>';
-    $this->assertRaw($message, t('Can\'t upload a disallowed extension'));
-    $this->assertRaw(t('Epic upload FAIL!'), t('Found the failure message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate'));
-
-    // Reset the hook counters.
-    file_test_reset();
-
-    $extensions = 'foo gif';
-    // Now tell file_save_upload() to allow ".gif".
-    $edit = array(
-      'file_test_replace' => FILE_EXISTS_REPLACE,
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
-      'extensions' => $extensions,
-    );
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $this->assertNoRaw(t('Only files with the following extensions are allowed:'), t('Can upload an allowed extension.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'load', 'update'));
-
-    // Reset the hook counters.
-    file_test_reset();
-
-    // Now tell file_save_upload() to allow any extension.
-    $edit = array(
-      'file_test_replace' => FILE_EXISTS_REPLACE,
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
-      'allow_all_extensions' => TRUE,
-    );
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $this->assertNoRaw(t('Only files with the following extensions are allowed:'), t('Can upload any extension.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'load', 'update'));
-  }
-
-  /**
-   * Test dangerous file handling.
-   */
-  function testHandleDangerousFile() {
-    // Allow the .php extension and make sure it gets renamed to .txt for
-    // safety. Also check to make sure its MIME type was changed.
-    $edit = array(
-      'file_test_replace' => FILE_EXISTS_REPLACE,
-      'files[file_test_upload]' => drupal_realpath($this->phpfile->uri),
-      'is_image_file' => FALSE,
-      'extensions' => 'php',
-    );
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $message = t('For security reasons, your upload has been renamed to ') . '<em class="placeholder">' . $this->phpfile->filename . '.txt' . '</em>';
-    $this->assertRaw($message, t('Dangerous file was renamed.'));
-    $this->assertRaw(t('File MIME type is text/plain.'), t('Dangerous file\'s MIME type was changed.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'insert'));
-
-    // Ensure dangerous files are not renamed when insecure uploads is TRUE.
-    // Turn on insecure uploads.
-    variable_set('allow_insecure_uploads', 1);
-    // Reset the hook counters.
-    file_test_reset();
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $this->assertNoRaw(t('For security reasons, your upload has been renamed'), t('Found no security message.'));
-    $this->assertRaw(t('File name is !filename', array('!filename' => $this->phpfile->filename)), t('Dangerous file was not renamed when insecure uploads is TRUE.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'insert'));
-
-    // Turn off insecure uploads.
-    variable_set('allow_insecure_uploads', 0);
-  }
-
-  /**
-   * Test file munge handling.
-   */
-  function testHandleFileMunge() {
-    // Ensure insecure uploads are disabled for this test.
-    variable_set('allow_insecure_uploads', 0);
-    $this->image = file_move($this->image, $this->image->uri . '.foo.gif');
-
-    // Reset the hook counters to get rid of the 'move' we just called.
-    file_test_reset();
-
-    $extensions = 'gif';
-    $edit = array(
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
-      'extensions' => $extensions,
-    );
-
-    $munged_filename = $this->image->filename;
-    $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
-    $munged_filename .= '_.gif';
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $this->assertRaw(t('For security reasons, your upload has been renamed'), t('Found security message.'));
-    $this->assertRaw(t('File name is !filename', array('!filename' => $munged_filename)), t('File was successfully munged.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'insert'));
-
-    // Ensure we don't munge files if we're allowing any extension.
-    // Reset the hook counters.
-    file_test_reset();
-
-    $edit = array(
-      'files[file_test_upload]' => drupal_realpath($this->image->uri),
-      'allow_all_extensions' => TRUE,
-    );
-
-    $this->drupalPost('file-test/upload', $edit, t('Submit'));
-    $this->assertResponse(200, t('Received a 200 response for posted test file.'));
-    $this->assertNoRaw(t('For security reasons, your upload has been renamed'), t('Found no security message.'));
-    $this->assertRaw(t('File name is !filename', array('!filename' => $this->image->filename)), t('File was not munged when allowing any extension.'));
-    $this->assertRaw(t('You WIN!'), t('Found the success message.'));
-
-    // Check that the correct hooks were called.
-    $this->assertFileHooksCalled(array('validate', 'insert'));
-  }
-
-  /**
    * Test renaming when uploading over a file that already exists.
    */
   function testExistingRename() {
Index: modules/simpletest/tests/file_test.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/file_test.module,v
retrieving revision 1.23
diff -u -p -r1.23 file_test.module
--- modules/simpletest/tests/file_test.module	26 Jun 2010 19:55:47 -0000	1.23
+++ modules/simpletest/tests/file_test.module	30 Jun 2010 11:23:46 -0000
@@ -47,7 +47,7 @@ function file_test_stream_wrappers() {
 function _file_test_form($form, &$form_state) {
   $form['file_test_upload'] = array(
     '#type' => 'file',
-    '#title' => t('Upload a file'),
+    '#title' => t('Upload an image'),
   );
   $form['file_test_replace'] = array(
     '#type' => 'select',
@@ -61,28 +61,9 @@ function _file_test_form($form, &$form_s
   );
   $form['file_subdir'] = array(
     '#type' => 'textfield',
-    '#title' => t('Subdirectory for test file'),
+    '#title' => 'Subdirectory for test image',
     '#default_value' => '',
   );
-
-  $form['extensions'] = array(
-    '#type' => 'textfield',
-    '#title' => t('Allowed extensions.'),
-    '#default_value' => '',
-  );
-
-  $form['allow_all_extensions'] = array(
-    '#type' => 'checkbox',
-    '#title' => t('Allow all extensions?'),
-    '#default_value' => FALSE,
-  );
-
-  $form['is_image_file'] = array(
-    '#type' => 'checkbox',
-    '#title' => t('Is this an image file?'),
-    '#default_value' => TRUE,
-  );
-
   $form['submit'] = array(
     '#type' => 'submit',
     '#value' => t('Submit'),
@@ -94,7 +75,7 @@ function _file_test_form($form, &$form_s
  * Process the upload.
  */
 function _file_test_form_submit(&$form, &$form_state) {
-  // Process the upload and perform validation. Note: we're using the
+  // Process the upload and validate that it is an image. Note: we're using the
   // form value for the $replace parameter.
   if (!empty($form_state['values']['file_subdir'])) {
     $destination = 'temporary://' . $form_state['values']['file_subdir'];
@@ -103,26 +84,10 @@ function _file_test_form_submit(&$form, 
   else {
     $destination = FALSE;
   }
-
-  // Setup validators.
-  $validators = array();
-  if ($form_state['values']['is_image_file']) {
-    $validators['file_validate_is_image'] = array();
-  }
-
-  if ($form_state['values']['allow_all_extensions']) {
-    $validators['file_validate_extensions'] = array();
-  }
-  else if (!empty($form_state['values']['extensions'])) {
-    $validators['file_validate_extensions'] = array($form_state['values']['extensions']);
-  }
-
-  $file = file_save_upload('file_test_upload', $validators, $destination, $form_state['values']['file_test_replace']);
+  $file = file_save_upload('file_test_upload', array('file_validate_is_image' => array()), $destination, $form_state['values']['file_test_replace']);
   if ($file) {
     $form_state['values']['file_test_upload'] = $file;
     drupal_set_message(t('File @filepath was uploaded.', array('@filepath' => $file->uri)));
-    drupal_set_message(t('File name is @filename.', array('@filename' => $file->filename)));
-    drupal_set_message(t('File MIME type is @mimetype.', array('@mimetype' => $file->filemime)));
     drupal_set_message(t('You WIN!'));
   }
   elseif ($file === FALSE) {
Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.484
diff -u -p -r1.484 system.install
--- modules/system/system.install	29 Jun 2010 16:52:11 -0000	1.484
+++ modules/system/system.install	30 Jun 2010 11:23:46 -0000
@@ -2454,15 +2454,9 @@ function system_update_7054() {
   // Update: update_fix_d7_requirements() installs this version for cache_path
   // already, so we don't include it in this particular update. It should be
   // included in later updates though.
-  $cache_tables = array(
-    'cache' => 'Generic cache table for caching things not separated out into their own tables. Contributed modules may also use this to store cached items.',
-    'cache_form' => 'Cache table for the form system to store recently built forms and their storage data, to be used in subsequent page requests.',
-    'cache_page' => 'Cache table used to store compressed pages for anonymous users, if page caching is enabled.',
-    'cache_menu' => 'Cache table for the menu system to store router information as well as generated link trees for various menu/page/user combinations.',
-  );
+  $cache_tables = array('cache', 'cache_form', 'cache_menu', 'cache_page');
   $schema = system_schema_cache_7054();
   foreach ($cache_tables as $table => $description) {
-    $schema['description'] = $description;
     db_drop_table($table);
     db_create_table($table, $schema);
   }