while ($row = $statement->fetchArray()) {
switch ($row['type']) {
case 'attachment':
- $fileLocation = $this->getAttachmentFilename($row['id_attach'], $row['id_folder'], $row['file_hash']);
+ $fileLocation = $this->getAttachmentFilename($row['id_attach'], $row['id_folder'], $row['file_hash'], $row['filename']);
break;
case 'user':
if (FileUtil::isURL($row['filename'])) return;
$statement = $this->database->prepareStatement($sql, $limit, $offset);
$statement->execute([0, 0]);
while ($row = $statement->fetchArray()) {
- $fileLocation = $this->getAttachmentFilename($row['id_attach'], $row['id_folder'], $row['file_hash']);
+ $fileLocation = $this->getAttachmentFilename($row['id_attach'], $row['id_folder'], $row['file_hash'], $row['filename']);
if ($imageSize = @getimagesize($fileLocation)) {
$row['isImage'] = 1;
return $message;
}
- private function getAttachmentFilename($id, $dir, $hash) {
+ private function getAttachmentFilename($id, $dir, $hash, $filename) {
if (!empty($this->readOption('currentAttachmentUploadDir'))) {
// multiple attachments dir
static $dirs;
$path = $this->readOption('attachmentUploadDir');
}
- return $path . '/' . $id . '_' . $hash;
+ if ($hash) {
+ return $path . '/' . $id . '_' . $hash;
+ }
+ else {
+ // sanitize spaces
+ $filename = preg_replace('/\s/', '_', $filename);
+ // strip special characters
+ $filename = preg_replace('/[^\w_\.\-]/', '', $filename);
+
+ $scrambled = $id . '_' . str_replace('.', '_', $filename) . md5($filename);
+ if (file_exists($path . '/' . $scrambled)) {
+ return $path . '/' . $scrambled;
+ }
+
+ // collapsed consecutive dots
+ $filename = preg_replace('/\.{2,}/', '.', $filename);
+
+ return $path . '/' . $filename;
+ }
}
}