I have installed FlashVideo on a Drupal 5.7 installation, and configured it to use "video/import" as an import directory. I uploaded a video to be imported to sites/subdomain.example.com/files/video/import/example.flv.

From http://subdomain.example.com/admin/logs/status I click "run cron manually." The page returns with two notices:

  • For security reasons, your upload has been renamed to sites/subdomain.example_.com/files/example.flv.
  • Cron ran successfully

And one error:

  • The selected file sites/subdomain.example.com/files/video/import/example.flv could not be uploaded, because the destination is not properly configured.

I note that the error comes from within Drupal itself, while the "For security reasons..." message is produced by the function fv_file_munge_filename() in the file flashvideo.module. The comment for this function seems to indicate it has been copied from the analogous function in Drupal 6.x. However, it seems to be employed incorrectly. Also, the file move error is not being returned, so the message "Cron ran successfully" is misleading.

The expected values is sites/subdomain.example.com/files/example_.flv or something similar. With the current value, the file could be moved out of the sites/*/ folder belonging to the current site, which is probably a security issue of some kind.

At http://api.drupal.org/api/function/file_save_upload/6 observe:

    $file->filename = file_munge_filename(trim(basename($_FILES['files']['name'][$source]), '.'), $extensions);
    $file->filepath = $_FILES['files']['tmp_name'][$source];
    $file->filemime = $_FILES['files']['type'][$source];

Whereas in the function flashvideo_import():

            // Create a temporary file object.
            $tempfile->filepath = $file->filename;
            // Replace the covert directory with blank string so that it will move out of the convert directory.
            $tempfile->filepath = str_replace($path . '/', '', $tempfile->filepath);
            // Munge up the filename for security reasons.   
            $tempfile->filepath = fv_file_munge_filename($tempfile->filepath, '');

Two things: Here *file_munge_filename() is being called on the filepath instead of the filename, and no list of accepted extensions is given (maybe these should be the ones entered in the "[FileType, MimeType, DefaultPlayer] configuration:" field on the FlashVideo settings page?).

Since file_move is called later in flashvideo_import, and from looking at http://api.drupal.org/api/function/file_move/5, it should suffice to create two objects; one with a filepath of 'video_import' (or similar) and an original filename, and one with a filepath of '' and the munged filename. Calling file_move with these values should accomplish the move of the imported file.

I'm not sure if that is the expected result. If it is, I'll gladly write a patch to correct this issue, but I'd like clarification from the maintainer first.