note 57145 rejected from features.file-upload by jome

Note Submitter: znoob2 at yahoo dot com ---- As brion at pobox dot com points out, you should be very careful with magic quotes and file uploads. I found that with magic quotes gpc turned on, filenames that have a quote in it, get stripped awfully. Eg. Upload the file "evil'text.txt" $_FILES['file']['name'] is "text.txt" Now the filename looks less evil, but php took it, so now php is evil. Watch out, since you'll never be able to get that evil part unless you turn magic quotes gpc off.