UBB.Developers Forums UBB.threads 7 Development How Do I? Only a-z & 0-9 when uploading

When moving to a new host I had ro rename lots of uploaded files that used letters that got messed up when transfering the files.

How do I prevent this in the future?

I would like to ad a rule that only allows upload if a file is named with anything from a-z. 0-9 and _.

I thougt this was already in threads (I run 6.4.1), but I can´t find any settings regarding this.

Anyone?

I use something like this on the submitted filename :

//replace all spaces with underscore
$filename = str_replace(" ", "_", $filename );
//remove all non wanted characters
$filename = preg_replace('([^_a-zA-Z0-9\-\.])', '', $filename);

So with this users can name the files any way they want, and the name will be changed upon upload?

Where do you put this?

>So with this users can name the files any way they want, and the name will be
>changed upon upload?

Yes.

>Where do you put this?

Well, I don´t know how exactly you handle uploads, but usually you fill have a form, something like this
<FORM ACTION="$PHP_SELF" METHOD=POST ENCTYPE="multipart/form-data">
<INPUT TYPE=FILE NAME="userfile"><BR>
<INPUT TYPE=HIDDEN NAME="action" VALUE="post">

So after the file is uploaded, the file is under the php variable $userfile .

To tidy its name, I do the following:

//tidy up user's filename
$userfile_name = str_replace(" ", "_", $userfile_name);
$userfile_name = preg_replace('([^_a-zA-Z0-9\-\.])', '', $userfile_name);
$userfile_name = str_replace(".jpeg", ".jpg", $userfile_name);
$userfile_name = str_replace(".JPG", ".jpg", $userfile_name);
$userfile_name = str_replace(".GIF", ".gif", $userfile_name);
$userfile_name = str_replace(".PNG", ".png", $userfile_name);

Read http://at2.php.net/features.file-upload

Here is a tutorial on file upload.
http://www.zend.com/zend/spotlight/uploading.php
also here:
http://forums.devshed.com/archive/5/2001/3/3/12353

But will this really integrate with Threads?

Ok....
So....backup the file you are going to edit.
In
addpost.php
find:
$FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";

Replace with:

$HTTP_POST_FILES['userfile']['name'] = str_replace(" ", "_", {$HTTP_POST_FILES['userfile']['name']});
$HTTP_POST_FILES['userfile']['name'] = preg_replace('([^_a-zA-Z0-9\-\.])', '', {$HTTP_POST_FILES['userfile']['name']});
$FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";

try it out and report if it works, I havent tested it becuase I don´t use this upload.

If this doesn´t work (I´m not sure if one can asign new values to server side variables), then this should work:

In
addpost.php
find:
$FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";

Replace with:

$uploadname = $HTTP_POST_FILES['userfile']['name'];
$uploadname = str_replace(" ", "_", $uploadname);
$uploadname = preg_replace('([^_a-zA-Z0-9\-\.])', '', $uploadname);
$FileName = "$Mnumber-$uploadname";

So did anyone try this out?

No? Ok.