Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-9615

When attaching a file whose name contains quotes, filename before last quote is cut off in display

    Details

    • Type: Bug
    • Status: Unverified Fix
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.0.7-PL1
    • Fix Version/s: 3.0.8-RC1
    • Component/s: Posting
    • Labels:
      None
    • Environment:
      PHP Version 4.4.9
      MySQL 5.0.81-log

      Description

      Support topic: http://www.phpbb.com/community/viewtopic.php?f=46&t=2091805

      When any user wants to attach a file with name like ''Mark's file'' or other using of combination of signs ''abc's file'', the final attachment's name showed in forum is only '' 's file'', the letters in front apostrophe are ignored.

      I tested on my board with a filename containing single and double quotes:

      Original filename:

      test ' yy " xx.txt

      Displayed filename:

      " xx.txt

      Seems like all text before the last single or double quote is killed off.

        Activity

        Hide
        bantu Andreas Fischer added a comment -

        Copied environment from support topic. Could be a PHP4 issue.

        Show
        bantu Andreas Fischer added a comment - Copied environment from support topic. Could be a PHP4 issue.
        Hide
        bantu Andreas Fischer added a comment -

        Oh wait, it has been reproduced on PHP5.

        Show
        bantu Andreas Fischer added a comment - Oh wait, it has been reproduced on PHP5.
        Hide
        ToonArmy Chris Smith added a comment -

        Can you try adding magic_quotes_gpc=off to your php.ini, it solves the problem for me. If this is the issue we need to file an issue with the PHP docs as they do not mention that magic quotes applies to $_FILES.

        Show
        ToonArmy Chris Smith added a comment - Can you try adding magic_quotes_gpc=off to your php.ini, it solves the problem for me. If this is the issue we need to file an issue with the PHP docs as they do not mention that magic quotes applies to $_FILES.
        Hide
        bantu Andreas Fischer added a comment -

        magic_quotes_gpc was off in the environment I posted above.

        Show
        bantu Andreas Fischer added a comment - magic_quotes_gpc was off in the environment I posted above.
        Hide
        bantu Andreas Fischer added a comment -

        The problem is in functions_upload.php, calling utf8_basename() before stripslashes().

        $name = trim(utf8_htmlspecialchars(utf8_basename($upload_ary['name'])));
        $this->realname = $this->uploadname = (STRIP) ? stripslashes($name) : $name;

        $_FILES seems to be indeed affected by magic_quotes_gpc.

        Show
        bantu Andreas Fischer added a comment - The problem is in functions_upload.php, calling utf8_basename() before stripslashes(). $name = trim(utf8_htmlspecialchars(utf8_basename($upload_ary['name']))); $this->realname = $this->uploadname = (STRIP) ? stripslashes($name) : $name; $_FILES seems to be indeed affected by magic_quotes_gpc.

          People

          • Assignee:
            bantu Andreas Fischer
            Reporter:
            Oleg Oleg [X] (Inactive)
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development