Added some verification to avoid exploits.

jrbasso · Jan 3, 2010 · 6ec1ef4 · 6ec1ef4
1 parent b7bdee1
commit 6ec1ef4
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/models/behaviors/meio_upload.php b/models/behaviors/meio_upload.php
@@ -1055,6 +1055,9 @@ function _createFolders($dir, $thumbsizes) {
  **/
 	function _copyFileFromTemp($tmpName, $saveAs) {
 		$results = true;
+		if (!is_uploaded_file($tmpName)) {
+			return false;
+		}
 		$file = new File($tmpName, $saveAs);
 		$temp = new File($saveAs, true);
 		if (!$temp->write($file->read())) {