--- file.inc.drupal_6_2 2008-04-13 08:50:37.000000000 +0200 +++ file.inc 2008-04-18 09:42:52.000000000 +0200 @@ -491,14 +491,16 @@ function file_save_upload($source, $vali return $upload_cache[$source]; } - // If a file was uploaded, process it. - if (isset($_FILES['files']) && $_FILES['files']['name'][$source] && is_uploaded_file($_FILES['files']['tmp_name'][$source])) { - // Check for file upload errors and return FALSE if a - // lower level system error occurred. + // If no file was uploaded, return 0 (unexpected error) + if (!isset($_FILES['files']) || !$_FILES['files']['name'][$source]) { + return 0; + } + + // Check for file upload errors and return 0 if a low level system error occurred. + if (!is_uploaded_file($_FILES['files']['tmp_name'][$source]) || $_FILES['files']['error'][$source] != UPLOAD_ERR_OK) { switch ($_FILES['files']['error'][$source]) { + // @see http://php.net/manual/en/features.file-upload.errors.php - case UPLOAD_ERR_OK: - break; case UPLOAD_ERR_INI_SIZE: case UPLOAD_ERR_FORM_SIZE: @@ -515,78 +517,79 @@ function file_save_upload($source, $vali drupal_set_message(t('The file %file could not be saved. An unknown error has occurred.', array('%file' => $source)), 'error'); return 0; } + } - // Build the list of non-munged extensions. - // @todo: this should not be here. we need to figure out the right place. - $extensions = ''; - foreach ($user->roles as $rid => $name) { - $extensions .= ' '. variable_get("upload_extensions_$rid", - variable_get('upload_extensions_default', 'jpg jpeg gif png txt html doc xls pdf ppt pps odt ods odp')); - } - - // Begin building file object. - $file = new stdClass(); - $file->filename = file_munge_filename(trim(basename($_FILES['files']['name'][$source]), '.'), $extensions); - $file->filepath = $_FILES['files']['tmp_name'][$source]; - $file->filemime = $_FILES['files']['type'][$source]; - - // Rename potentially executable files, to help prevent exploits. - if (preg_match('/\.(php|pl|py|cgi|asp|js)$/i', $file->filename) && (substr($file->filename, -4) != '.txt')) { - $file->filemime = 'text/plain'; - $file->filepath .= '.txt'; - $file->filename .= '.txt'; - } - - // If the destination is not provided, or is not writable, then use the - // temporary directory. - if (empty($dest) || file_check_path($dest) === FALSE) { - $dest = file_directory_temp(); - } - - $file->source = $source; - $file->destination = file_destination(file_create_path($dest .'/'. $file->filename), $replace); - $file->filesize = $_FILES['files']['size'][$source]; - - // Call the validation functions. - $errors = array(); - foreach ($validators as $function => $args) { - array_unshift($args, $file); - $errors = array_merge($errors, call_user_func_array($function, $args)); - } - - // Check for validation errors. - if (!empty($errors)) { - $message = t('The selected file %name could not be uploaded.', array('%name' => $file->filename)); - if (count($errors) > 1) { - $message .= ''; - } - else { - $message .= ' '. array_pop($errors); - } - form_set_error($source, $message); - return 0; + // The file was successfully uploaded, process it. + + // Build the list of non-munged extensions. + // @todo: this should not be here. we need to figure out the right place. + $extensions = ''; + foreach ($user->roles as $rid => $name) { + $extensions .= ' '. variable_get("upload_extensions_$rid", + variable_get('upload_extensions_default', 'jpg jpeg gif png txt html doc xls pdf ppt pps odt ods odp')); + } + + // Begin building file object. + $file = new stdClass(); + $file->filename = file_munge_filename(trim(basename($_FILES['files']['name'][$source]), '.'), $extensions); + $file->filepath = $_FILES['files']['tmp_name'][$source]; + $file->filemime = $_FILES['files']['type'][$source]; + + // Rename potentially executable files, to help prevent exploits. + if (preg_match('/\.(php|pl|py|cgi|asp|js)$/i', $file->filename) && (substr($file->filename, -4) != '.txt')) { + $file->filemime = 'text/plain'; + $file->filepath .= '.txt'; + $file->filename .= '.txt'; + } + + // If the destination is not provided, or is not writable, then use the + // temporary directory. + if (empty($dest) || file_check_path($dest) === FALSE) { + $dest = file_directory_temp(); + } + + $file->source = $source; + $file->destination = file_destination(file_create_path($dest .'/'. $file->filename), $replace); + $file->filesize = $_FILES['files']['size'][$source]; + + // Call the validation functions. + $errors = array(); + foreach ($validators as $function => $args) { + array_unshift($args, $file); + $errors = array_merge($errors, call_user_func_array($function, $args)); + } + + // Check for validation errors. + if (!empty($errors)) { + $message = t('The selected file %name could not be uploaded.', array('%name' => $file->filename)); + if (count($errors) > 1) { + $message .= ''; + } + else { + $message .= ' '. array_pop($errors); } + form_set_error($source, $message); + return 0; + } - // Move uploaded files from PHP's upload_tmp_dir to Drupal's temporary directory. - // This overcomes open_basedir restrictions for future file operations. - $file->filepath = $file->destination; - if (!move_uploaded_file($_FILES['files']['tmp_name'][$source], $file->filepath)) { - form_set_error($source, t('File upload error. Could not move uploaded file.')); - watchdog('file', 'Upload error. Could not move uploaded file %file to destination %destination.', array('%file' => $file->filename, '%destination' => $file->filepath)); - return 0; - } - - // If we made it this far it's safe to record this file in the database. - $file->uid = $user->uid; - $file->status = FILE_STATUS_TEMPORARY; - $file->timestamp = time(); - drupal_write_record('files', $file); - - // Add file to the cache. - $upload_cache[$source] = $file; - return $file; + // Move uploaded files from PHP's upload_tmp_dir to Drupal's temporary directory. + // This overcomes open_basedir restrictions for future file operations. + $file->filepath = $file->destination; + if (!move_uploaded_file($_FILES['files']['tmp_name'][$source], $file->filepath)) { + form_set_error($source, t('File upload error. Could not move uploaded file.')); + watchdog('file', 'Upload error. Could not move uploaded file %file to destination %destination.', array('%file' => $file->filename, '%destination' => $file->filepath)); + return 0; } - return 0; + + // If we made it this far it's safe to record this file in the database. + $file->uid = $user->uid; + $file->status = FILE_STATUS_TEMPORARY; + $file->timestamp = time(); + drupal_write_record('files', $file); + + // Add file to the cache. + $upload_cache[$source] = $file; + return $file; } /**