[pmwiki-users] MakeUploadNamePatterns surprise

Petko Yotov 5ko at 5ko.fr
Sun Jun 22 15:16:34 CDT 2014


You are not the only one using "_" in $*Patterns variables and the same 
problem may appear on other wikis upon upgrade. That's why I added a specific 
check and from the next version on if the replacement pattern is simply "_" it 
will not be considered a function.

If someone uses gettext() directly in $MakePageNamePatterns or in 
$MakeUploadNamePatterns which I doubt, they should use the 'gettext' name and 
not the '_' abbreviation.

Petko

On 06/17/2014 11:51 AM, Carles Escrig Royo wrote:
> Hi all,
> 
> I used to have the $MakeUploadNamePatterns defined as:
> 
> $UploadNameChars = "-\\w. ";
> $MakeUploadNamePatterns = array(
>     "/[^$UploadNameChars]/" => '',
>     '/\\.[^.]*$/e' => 'strtolower("$0")',
>     '/^[^[:alnum:]_]+/' => '',
>     '/[^[:alnum:]_]+$/' => '',
>     '/\\s/' => '_');
> 
> Note it only differs with default on the space-underscore substitution.
> 
> I just upgraded php and all other software in the server, and to my
> surprise filenames are not sanitized as expected any more. Lots of files
> are not recognized because their sanitized name is different :(
> 
> The reason is that "_" is now a callable function of php:
> 
> http://fr.php.net/_
> 
> (Or, may be I didn't have the gettext extension enabled before)
> 
> Anyway, do you think It's possible to bypass the problem without
> modifying scripts/upload.php?



More information about the pmwiki-users mailing list