From fa62496107d69198b70820d914abd3148d68e602 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 17 Mar 2017 10:49:13 +0100
Subject: [PATCH] Fix so settings/upload.inc could not be used by plugins
 (#5694)

---
 CHANGELOG                         | 1 +
 program/steps/settings/upload.inc | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 360242a5402..7ce02917fad 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,6 +25,7 @@ RELEASE 1.2.4
 - Add rewrite rule to disable access to /vendor/bin folder in .htaccess (#5630)
 - Fix bug where it was too easy accidentally move a folder when using the subscription checkbox (#5655)
 - Fix XSS issue in handling of a style tag inside of an svg element
+- Fix so settings/upload.inc could not be used by plugins (#5694)
 
 RELEASE 1.2.3
 -------------
diff --git a/program/steps/settings/upload.inc b/program/steps/settings/upload.inc
index 0cf7ae60cf1..5e91f1d20f4 100644
--- a/program/steps/settings/upload.inc
+++ b/program/steps/settings/upload.inc
@@ -27,6 +27,11 @@ if (!empty($_GET['_progress'])) {
 $from = rcube_utils::get_input_value('_from', rcube_utils::INPUT_GET);
 $type = preg_replace('/(add|edit)-/', '', $from);
 
+// Plugins in Settings may use this file for some uploads (#5694)
+// Make sure it does not contain a dot, which is a special character
+// when using rcube_session::append() below
+$type = str_replace('.', '-', $type);
+
 if ($RCMAIL->action == 'upload-display') {
     $id = 'undefined';