Index: includes/file.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/file.inc,v
retrieving revision 1.218
diff -u -r1.218 file.inc
--- includes/file.inc	7 Jul 2010 01:10:35 -0000	1.218
+++ includes/file.inc	26 Jul 2010 00:03:24 -0000
@@ -850,10 +850,19 @@
 /**
  * Modify a filename as needed for security purposes.
  *
- * Dangerous file names will be altered; for instance, the file name
- * "exploit.php.pps" will become "exploit.php_.pps". All extensions that are
- * between 2 and 5 characters in length, internal to the file name, and not
- * included in $extensions will be altered by adding an underscore. If variable
+ * Munging file names is needed to prevent unknown file extensions from masking
+ * exploit files. The reason is that when web servers such as Apache are trying
+ * to decide how to process a URL request, they key off the file extension. If
+ * the extension is not recognized, Apache will skip that extension and look
+ * at the previous file extension. So for instance, if the file being requested
+ * is exploit.php.pps, and Apache does not recognize the '.pps' extension, it
+ * will treat the file as PHP (and execute it). To make this file name safe for
+ * Apache and prevent it from executing as PHP, the .php extension is "munged"
+ * into .php_, making the safe file name exploit.php_.pps.
+ *
+ * Specifically, in this function all extensions that are between 2 and 5
+ * characters in length, internal to the file name, and not included in
+ * $extensions will be altered by adding an underscore. If variable
  * 'allow_insecure_uploads' evaluates to TRUE, no alterations will be made.
  *
  * @param $filename