diff --git a/ground/controllers/ImagesController.php b/ground/controllers/ImagesController.php index 81f9f8e..28671d9 100644 --- a/ground/controllers/ImagesController.php +++ b/ground/controllers/ImagesController.php @@ -52,7 +52,13 @@ class ImagesController extends Controller $uploaddir = App::getBasedir() . '../public/photos/articles/'; $fileName = (string)$_FILES['photo']['name']; $temp = pathinfo($fileName); - $extension = strtolower($temp['extension']) ? strtolower($temp['extension']) : 'jpg'; + $extension = strtolower($temp['extension']); + + if (array_search($extension, array('jpg','jpeg','png')) === FALSE || getimagesize($_FILES['photo']['tmp_name']) === false) { + print 'error'; + die; + } + $photo = $userId . strtolower('_' . substr(md5($fileName . time()), 0, 5) . '.' . $extension); if (move_uploaded_file($_FILES['photo']['tmp_name'], $uploaddir . $photo)) { ArticlePhotos::model()->add(array( diff --git a/ground/views/articles/edit.php b/ground/views/articles/edit.php index 3cd0638..05a483d 100644 --- a/ground/views/articles/edit.php +++ b/ground/views/articles/edit.php @@ -1,5 +1,10 @@
@@ -76,10 +81,10 @@ function insertAtCursor(myField, myValue) {
- +
- - + +
@@ -90,6 +95,6 @@ function insertAtCursor(myField, myValue) {
- +