Dissallow all uploads starting with .htaccess

pluck-cms · Dec 19, 2019 · f79f916 · f79f916
1 parent c140ff8
commit f79f916
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/data/inc/files.php b/data/inc/files.php
@@ -33,7 +33,7 @@
 <?php
 if (isset($_POST['submit'])) {
 	$filenamestr = strtolower(latinOnlyInput($_FILES['filefile']['name']));
-	if ($filenamestr == '.htaccess'){
+	if ($filenamestr == '.htaccess' or strtolower(substr($filenamestr, 0, 9)) == '.htaccess'){
 		show_error($lang['general']['upload_failed'], 1);
 	} else {
 		if (!copy($_FILES['filefile']['tmp_name'], 'files/'.latinOnlyInput(latinOnlyInput($_FILES['filefile']['name']))))