| @@ -650,13 +650,13 @@ | ||
| 650 | 650 | 'size' => filesize(ACYM_ROOT.$filepath), |
| 651 | 651 | ]; |
| 652 | 652 | |
| 653 | 653 | //We will never allow some files to be uploaded... |
| 654 | - if (preg_match('#\.(php.?|.?htm.?|pl|py|jsp|asp|sh|cgi)#Ui', $attachment['filename'])) { | |
| 654 | + if (acym_isForbiddenFileExtension($attachment['filename'])) { | |
| 655 | 655 | acym_enqueueMessage( |
| 656 | 656 | acym_translationSprintf( |
| 657 | 657 | 'ACYM_ACCEPTED_TYPE', |
| 658 | - substr($attachment['filename'], strrpos($attachment['filename'], '.') + 1), | |
| 658 | + esc_html(substr($attachment['filename'], strrpos($attachment['filename'], '.') + 1)), | |
| 659 | 659 | $this->config->get('allowed_files') |
| 660 | 660 | ), |
| 661 | 661 | 'notice' |
| 662 | 662 | ); |
| @@ -989,9 +989,9 @@ | ||
| 989 | 989 | $newPathComplete = $newPath.'.'.$extension; |
| 990 | 990 | |
| 991 | 991 | $allowedExtensions = acym_getImageFileExtensions(true); |
| 992 | 992 | if (!in_array($extension, $allowedExtensions)) { |
| 993 | - $errorMessage = acym_translationSprintf('ACYM_ACCEPTED_TYPE', $extension, implode(', ', $allowedExtensions)); | |
| 993 | + $errorMessage = acym_translationSprintf('ACYM_ACCEPTED_TYPE', esc_html($extension), implode(', ', $allowedExtensions)); | |
| 994 | 994 | } elseif (!acym_uploadFile($file['tmp_name'], ACYM_ROOT.$newPathComplete)) { |
| 995 | 995 | $errorMessage = acym_translationSprintf('ACYM_ERROR_UPLOADING_FILE_X', $newPathComplete); |
| 996 | 996 | } elseif (strtolower($extension) === 'svg' && !acym_isSvgFileSafe(ACYM_ROOT.$newPathComplete)) { |
| 997 | 997 | acym_deleteFile(ACYM_ROOT.$newPathComplete); |
