Fix user input for not including new lines

diff --git a/lib/functions.php b/lib/functions.php
index b658b17d19b9727b80217058f6a18360e3808564..d70a17c77826715cfcc846e6e96f113c419d38bc 100755 (executable)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -329,7 +329,7 @@ jirafeau_upload ($file, $one_time_download, $key, $time, $ip)
 
     /* file informations */
     $md5 = md5_file ($file['tmp_name']);
 
     /* file informations */
     $md5 = md5_file ($file['tmp_name']);

-    $name = trim ($file['name']);
+    $name = str_replace (NL, '', trim ($file['name']));

     $mime_type = $file['type'];
     $size = $file['size'];
 
     $mime_type = $file['type'];
     $size = $file['size'];
 


@@ -801,7 +801,7 @@ jirafeau_async_init ($filename, $type, $one_time, $key, $time, $ip)
     $p .= $ref;
     $handle = fopen ($p, 'w');
     fwrite ($handle,
     $p .= $ref;
     $handle = fopen ($p, 'w');
     fwrite ($handle,

-            $filename . NL. $type . NL. $password . NL. $time . NL .
+            str_replace (NL, '', trim ($filename)) . NL. trim ($type) . NL. $password . NL. $time . NL .

             ($one_time ? 'O' : 'R') . NL . $ip . NL . date ('U') . NL .
             $code . NL);
     fclose ($handle);
             ($one_time ? 'O' : 'R') . NL . $ip . NL . date ('U') . NL .
             $code . NL);
     fclose ($handle);

diff --git a/script.php b/script.php
index ad354a5695b909072f57b37adcd74f796758eee7..396538ccc0a86ad9060680b3eac5dd264b482fbd 100755 (executable)
--- a/script.php
+++ b/script.php
@@ -485,11 +485,11 @@ elseif (isset ($_GET['init_async']))
                 break;\r
         }\r
     echo jirafeau_async_init ($_POST['filename'],\r
                 break;\r
         }\r
     echo jirafeau_async_init ($_POST['filename'],\r

-                                     $type,\r
-                                     isset ($_POST['one_time_download']),\r
-                                     $key,\r
-                                     $time,\r
-                                     $_SERVER['REMOTE_ADDR']);\r
+                              $type,\r
+                              isset ($_POST['one_time_download']),\r
+                              $key,\r
+                              $time,\r
+                              $_SERVER['REMOTE_ADDR']);\r

 }\r
 /* Continue an asynchronous upload. */\r
 elseif (isset ($_GET['push_async']))\r
 }\r
 /* Continue an asynchronous upload. */\r
 elseif (isset ($_GET['push_async']))\r