Changeset 1041

Show
Ignore:
Timestamp:
08/23/07 11:21:31 (1 year ago)
Author:
donncha
Message:

Use mime_content_type() if available, finfo_file() anyone?
Sanitize filename, props Alexander Concha

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/wp-content/blogs.php

    r857 r1041  
    7070 
    7171 
    72 $file = $_GET[ 'file' ]; 
    73  
    74 $file = constant( "ABSPATH" ) . constant( "UPLOADS" ) . $file; 
     72$file = constant( "ABSPATH" ) . constant( "UPLOADS" ) . str_replace( '..', '', $_GET[ 'file' ] ); 
    7573if ( !is_file( $file ) ) { 
    7674        header("HTTP/1.1 404 Not Found"); 
    …… 
    7876} 
    7977 
    80 $mime = wp_check_filetype( $_SERVER[ 'REQUEST_URI' ] ); 
     78if( function_exists( "mime_content_type" ) ) { 
     79        $mime[ 'type' ] = mime_content_type( $_SERVER[ 'REQUEST_URI' ] ); 
     80} else { 
     81        $mime = wp_check_filetype( $_SERVER[ 'REQUEST_URI' ] ); 
     82} 
    8183if( $mime[ 'type' ] != false ) { 
    8284        $mimetype = $mime[ 'type' ];