When uploading a file called something like "test(123.jpg" the following error message was shown on the screen, and in logs.

preg_match() [<a href='function.preg-match'>function.preg-match</a>]: Compilation failed: unmatched parentheses at offset 100 in .../sites/all/modules/filefield_paths/filefield_paths.module on line 539.

This line of code is doing

    ${$field} = (preg_match("/{$pattern['regex']}/s", $data))

Obviously the filename is being used (unescaped!) in a regex. This is pretty bad, because filenames are completely uncontrolled, and could potentially do all kinds of crazy pcre stuff. I worked around the issue by using http://drupal.org/project/transliteration module, but this module should protect itself from "bad" filenames.

Comments

deciphered’s picture

Issue summary: View changes
Status: Active » Closed (won't fix)

No longer supporting Drupal 6 issues for this module.