When uploading a file called something like "test(123.jpg" the following error message was shown on the screen, and in logs.
preg_match() [<a href='function.preg-match'>function.preg-match</a>]: Compilation failed: unmatched parentheses at offset 100 in .../sites/all/modules/filefield_paths/filefield_paths.module on line 539.
This line of code is doing
${$field} = (preg_match("/{$pattern['regex']}/s", $data))
Obviously the filename is being used (unescaped!) in a regex. This is pretty bad, because filenames are completely uncontrolled, and could potentially do all kinds of crazy pcre stuff. I worked around the issue by using http://drupal.org/project/transliteration module, but this module should protect itself from "bad" filenames.
Comments
Comment #1
decipheredNo longer supporting Drupal 6 issues for this module.