Update filemanager.php

https://github.com/opencart/opencart/blob/master/upload/admin/controller/common/filemanager.php
condor2 · Feb 12, 2024 · 457e2f3 · 457e2f3
1 parent 790cc5a
commit 457e2f3
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/upload/admin/controller/common/filemanager.php b/upload/admin/controller/common/filemanager.php
@@ -237,7 +237,7 @@ public function upload(): void {
 			foreach ($files as $file) {
 				if (is_file($file['tmp_name'])) {
 					// Sanitize the filename
-					$filename = preg_replace('[/\?%*:|"<>]', '', basename(html_entity_decode($file['name'], ENT_QUOTES, 'UTF-8')));
+					$filename = preg_replace('/[\/\\\\?%*:|"<>]/', '', basename(html_entity_decode($file['name'], ENT_QUOTES, 'UTF-8')));
 
 					// Validate the filename length
 					if ((utf8_strlen($filename) < 3) || (utf8_strlen($filename) > 255)) {
@@ -323,7 +323,7 @@ public function folder(): void {
 
 		if ($this->request->server['REQUEST_METHOD'] == 'POST') {
 			// Sanitize the folder name
-			$folder = preg_replace('[/\?%*:|"<>]', '', basename(html_entity_decode($this->request->post['folder'], ENT_QUOTES, 'UTF-8')));
+			$folder = preg_replace('/[\/\\\\?%*&:|"<>]/', '', basename(html_entity_decode($this->request->post['folder'], ENT_QUOTES, 'UTF-8')));
 
 			// Validate the filename length
 			if ((utf8_strlen($folder) < 3) || (utf8_strlen($folder) > 128)) {