X-Git-Url: http://git.harvie.cz/?a=blobdiff_plain;f=wwwroot%2Finc%2Ffilez.inc;h=d068cae33c113a901ba5e0876d0b651ae33cfd2f;hb=f657368b72f62699e51cb6b7efeb9e0b30f02f67;hp=b04932073c578de098468db60c71408e18c83003;hpb=33e10d4c5c188b6afdf78b1cb324277a1e61c4db;p=mirrors%2FKyberia-bloodline.git

diff --git a/wwwroot/inc/filez.inc b/wwwroot/inc/filez.inc
index b049320..d068cae 100644
--- a/wwwroot/inc/filez.inc
+++ b/wwwroot/inc/filez.inc
@@ -1,7 +1,9 @@
 <?php
 class filez {
 
-function filez($id) {
+//XXX function not used, remove?
+
+public static function files($id) {
 	global $db,$error;
 	if (!is_dir(FILE_DIR.$_SESSION['user_id'])) {
 		mkdir(FILE_DIR.$_SESSION['user_id']);
@@ -10,6 +12,22 @@ function filez($id) {
 	return $_SESSION['user_id'].'/'.$_FILES['data_file']['name'];
 }
 
+// Function that check if given filename is "secure" (for uploading)
+// Dont use for reading files, directory traversal is not checked
+
+public static function filename_secure(name){
+	$suffix = array_pop(explode('.', basename($name)));
+	
+	// This is unfornately blacklist
+	// TODO extend for all possible server configuations
+	// TODO: why js?
+	$preg_disallowed = '/([a-z]*)(php|htm|inc|js|vbs|cgi|asp|jsp|htaccess)([a-z]*)$/i';
+	if (preg_match($preg_disallowed, $suffix) > 0) {
+		return false;
+	}
+	return true;
+}
+
 }
 
 /*
@@ -43,4 +61,4 @@ function disk_usage($d, $depth = NULL) {
 }
 
 
-?>
\ No newline at end of file
+?>