From 597b41058274a64753686efe1d99ec3e21769dd7 Mon Sep 17 00:00:00 2001
From: oesi <oesi@technikum-wien.at>
Date: Tue, 7 Apr 2015 12:52:40 +0200
Subject: [PATCH] Upload von phtml Dateien verhindert

---
 cis/private/lehre/upload.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cis/private/lehre/upload.php b/cis/private/lehre/upload.php
index a29cc218c..aad50cc72 100644
--- a/cis/private/lehre/upload.php
+++ b/cis/private/lehre/upload.php
@@ -623,7 +623,7 @@
 													  }
 													  else
 													  {
-													  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && $file_name!='.htaccess')
+													  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && !stristr($uploadfile, '.phtml') && $file_name!='.htaccess')
 														  {
 														  	 if(copy($_FILES[$file]['tmp_name'], $uploadfile))
 														  	 {
@@ -646,7 +646,7 @@
 												  }
 												  else
 												  {
-												  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && $file_name!='.htaccess')
+												  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && !stristr($uploadfile, '.phtml') && $file_name!='.htaccess')
 													  {
 														  if(copy($_FILES[$file]['tmp_name'], $uploadfile))
 														  {
@@ -679,7 +679,7 @@
 														  }
 														  else
 														  {
-															  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && $file_name!='.htaccess')
+															  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && !stristr($uploadfile, '.phtml') && $file_name!='.htaccess')
 															  {
 															  	   if(copy($_FILES[$file]['tmp_name'], $uploadfile))
 															  	   {
@@ -702,7 +702,7 @@
 													  }
 													  else
 													  {
-													  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && $file_name!='.htaccess')
+													  	  if(!stristr($uploadfile, '.php') && !stristr($uploadfile, '.cgi') && !stristr($uploadfile, '.pl') && !stristr($uploadfile, '.phtml') && $file_name!='.htaccess')
 														  {
 															  if(copy($_FILES[$file]['tmp_name'], $uploadfile))
 															  {
@@ -1331,7 +1331,7 @@
 										{
 											if(!@file_exists($dest_dir->path.'/'.$new_file_name_) && !@is_dir($dest_dir->path.'/'.$new_file_name_))
 											{
-												if(!stristr($new_file_name_, '.php') && !stristr($new_file_name_, '.cgi') && !stristr($new_file_name_, '.pl') && $new_file_name_!='.htaccess')
+												if(!stristr($new_file_name_, '.php') && !stristr($new_file_name_, '.cgi') && !stristr($new_file_name_, '.pl') && !stristr($new_file_name_, '.phtml') && $new_file_name_!='.htaccess')
 												{
 													rename($dest_dir->path.'/'.$entry, $dest_dir->path.'/'.$new_file_name_);