From f79f9163f8eafd7149a2ea015256c08363476962 Mon Sep 17 00:00:00 2001
From: Bas S <github@bas.steelooper.com>
Date: Thu, 19 Dec 2019 17:45:17 +0100
Subject: [PATCH] Dissallow all uploads starting with .htaccess

---
 data/inc/files.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/inc/files.php b/data/inc/files.php
index 6e186509..478a8c38 100755
--- a/data/inc/files.php
+++ b/data/inc/files.php
@@ -33,7 +33,7 @@
 <?php
 if (isset($_POST['submit'])) {
 	$filenamestr = strtolower(latinOnlyInput($_FILES['filefile']['name']));
-	if ($filenamestr == '.htaccess'){
+	if ($filenamestr == '.htaccess' or strtolower(substr($filenamestr, 0, 9)) == '.htaccess'){
 		show_error($lang['general']['upload_failed'], 1);
 	} else {
 		if (!copy($_FILES['filefile']['tmp_name'], 'files/'.latinOnlyInput(latinOnlyInput($_FILES['filefile']['name']))))