Security: Rename htaccess file by replacing case-insensitively

AngelFQC · AngelFQC · commit dc7bfce429fb · 2023-07-13T10:15:03.000-05:00
diff --git a/main/inc/lib/fileUpload.lib.php b/main/inc/lib/fileUpload.lib.php
@@ -30,15 +30,17 @@ function php2phps($file_name)
 }
 
 /**
- * Renames .htaccess & .HTACCESS to htaccess.txt.
+ * Renames .htaccess & .HTACCESS & .htAccess to htaccess.txt.
  *
  * @param string $filename
  *
  * @return string
  */
 function htaccess2txt($filename)
 {
-    return str_replace(['.htaccess', '.HTACCESS'], ['htaccess.txt', 'htaccess.txt'], $filename);
+    $filename = strtolower($filename);
+
+    return str_replace('.htaccess', 'htaccess.txt', $filename);
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -30,15 +30,17 @@ function php2phps($file_name)`
`30`	`30`	`}`
`31`	`31`
`32`	`32`	`/**`
`33`		`- * Renames .htaccess & .HTACCESS to htaccess.txt.`
	`33`	`+ * Renames .htaccess & .HTACCESS & .htAccess to htaccess.txt.`
`34`	`34`	`*`
`35`	`35`	`* @param string $filename`
`36`	`36`	`*`
`37`	`37`	`* @return string`
`38`	`38`	`*/`
`39`	`39`	`function htaccess2txt($filename)`
`40`	`40`	`{`
`41`		`- return str_replace(['.htaccess', '.HTACCESS'], ['htaccess.txt', 'htaccess.txt'], $filename);`
	`41`	`+ $filename = strtolower($filename);`
	`42`	`+`
	`43`	`+ return str_replace('.htaccess', 'htaccess.txt', $filename);`
`42`	`44`	`}`
`43`	`45`
`44`	`46`	`/**`