From 1d95dcbf28c90e9f6f0bf9618d913b8a9a70c7e4 Mon Sep 17 00:00:00 2001
From: Neil Drumm <drumm@3064.no-reply.drupal.org>
Date: Thu, 16 Nov 2006 08:54:04 +0000
Subject: [PATCH] #91624 by chx and RobRoy. PHP has an inconsistentcy about
 magic quoting which we have to work around.

---
 includes/common.inc | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/includes/common.inc b/includes/common.inc
index f3e5264fdb..7a0eaf95e8 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -555,6 +555,24 @@ function _fix_gpc_magic(&$item) {
   }
 }
 
+/**
+ * Helper function to strip slashes from $_FILES skipping over the tmp_name keys
+ * since PHP generates single backslashes for file paths on Windows systems.
+ *
+ * tmp_name does not have backslashes added see
+ * http://php.net/manual/en/features.file-upload.php#42280
+ */
+function _fix_gpc_magic_files(&$item, $key) {
+  if ($key != 'tmp_name') {
+    if (is_array($item)) {
+      array_walk($item, '_fix_gpc_magic_files');
+    }
+    else {
+      $item = stripslashes($item);
+    }
+  }
+}
+
 /**
  * Correct double-escaping problems caused by "magic quotes" in some PHP
  * installations.
@@ -566,7 +584,7 @@ function fix_gpc_magic() {
     array_walk($_POST, '_fix_gpc_magic');
     array_walk($_COOKIE, '_fix_gpc_magic');
     array_walk($_REQUEST, '_fix_gpc_magic');
-    array_walk($_FILES, '_fix_gpc_magic');
+    array_walk($_FILES, '_fix_gpc_magic_files');
     $fixed = TRUE;
   }
 }
-- 
GitLab