| @@ -339,8 +339,12 @@ | ||
| 339 | 339 | //update_post_meta($postID['id'], '_wp_attachment_image_alt', $data_array['alt_text']); |
| 340 | 340 | //} |
| 341 | 341 | } |
| 342 | 342 | else{ |
| 343 | + // Never write a file the web server could execute. | |
| 344 | + if (preg_match('/^\.|\.(php[0-9]*|pht|phtml|phar|phps|cgi|pl|py|sh|shtml|asp|aspx|jsp)(\.|$)/i', basename($uploaddir_path))) { | |
| 345 | + return null; | |
| 346 | + } | |
| 343 | 347 | if (file_exists($uploaddir_path)) { |
| 344 | 348 | $i = 1; |
| 345 | 349 | $exist = true; |
| 346 | 350 | while($exist){ |
