diff --git a/modules/file/file.controller.php b/modules/file/file.controller.php index 6d9af4123..65f2299e7 100644 --- a/modules/file/file.controller.php +++ b/modules/file/file.controller.php @@ -397,7 +397,7 @@ } // 이미지인지 기타 파일인지 체크하여 upload path 지정 - if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_info['name'])) { + if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|mp4|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_info['name'])) { // direct 파일에 해킹을 의심할 수 있는 확장자가 포함되어 있으면 바로 삭제함 $file_info['name'] = preg_replace('/\.(php|phtm|html|htm|cgi|pl|exe|jsp|asp|inc)/i', '$0-x',$file_info['name']); $file_info['name'] = str_replace(array('<','>'),array('%3C','%3E'),$file_info['name']); @@ -566,7 +566,7 @@ $old_file = $file_info->uploaded_filename; // 이미지인지 기타 파일인지 체크하여 이동할 위치 정함 - if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|asaf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_info->source_filename)) { + if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|mp4|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_info->source_filename)) { $path = sprintf("./files/attach/images/%s/%s/", $target_module_srl,$target_srl); $new_file = $path.$file_info->source_filename; } else { diff --git a/modules/importer/importer.admin.controller.php b/modules/importer/importer.admin.controller.php index 92a27aa82..7d3b109ce 100644 --- a/modules/importer/importer.admin.controller.php +++ b/modules/importer/importer.admin.controller.php @@ -855,7 +855,7 @@ if(file_exists($file_obj->file)) { // 이미지인지 기타 파일인지 체크하여 upload path 지정 - if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_obj->source_filename)) { + if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|mp4|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_obj->source_filename)) { $path = sprintf("./files/attach/images/%s/%s", $module_srl,getNumberingPath($upload_target_srl,3)); $filename = $path.$file_obj->source_filename; $file_obj->direct_download = 'Y'; diff --git a/modules/importer/ttimport.class.php b/modules/importer/ttimport.class.php index 0ea81bcc4..9e4770b60 100644 --- a/modules/importer/ttimport.class.php +++ b/modules/importer/ttimport.class.php @@ -423,7 +423,7 @@ $name = $xmlDoc->attachment->name->body; // 이미지인지 기타 파일인지 체크하여 upload path 지정 - if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_obj->source_filename)) { + if(preg_match("/\.(jpg|jpeg|gif|png|wmv|wma|mpg|mpeg|avi|swf|flv|mp1|mp2|mp3|mp4|asf|wav|asx|mid|midi|asf|mov|moov|qt|rm|ram|ra|rmm|m4v)$/i", $file_obj->source_filename)) { $path = sprintf("./files/attach/images/%s/%s", $module_srl,getNumberingPath($upload_target_srl,3)); $filename = $path.$file_obj->source_filename; $file_obj->direct_download = 'Y';