Version 3.4.8

upload/ips_kernel/classUpload.php

@@ -3,9 +3,9 @@
 /**
  * <pre>
  * Invision Power Services
- * IP.Board v3.4.6
+ * IP.Board v3.4.8
  * Upload handler : Handles $_FILES and checks for security
- * Last Updated: $Date: 2013-02-19 06:02:12 -0500 (Tue, 19 Feb 2013) $
+ * Last Updated: $Date: 2014-09-09 04:24:53 -0400 (Tue, 09 Sep 2014) $
  * </pre>
  *
  * @author 		$Author: mmecham $
@@ -15,7 +15,7 @@
  * @subpackage	Kernel
  * @link		http://www.invisionpower.com
  * @since		15th March 2004
- * @version		$Revision: 12001 $
+ * @version		$Revision: 12497 $
  *
  *
  * Example Usage:
@@ -413,6 +413,13 @@ class classUpload
 			{
 				$img_attributes = @getimagesize( $this->saved_upload_name );
 				
+				if( !in_array( $img_attributes[2], array( IMAGETYPE_GIF, IMAGETYPE_JPEG, IMAGETYPE_PNG ) ) )
+				{
+					@unlink( $this->saved_upload_name );
+					$this->error_no = 5;
+					return false;
+				}
+			
 				if ( ! is_array( $img_attributes ) or !count( $img_attributes ) )
 				{
 					@unlink( $this->saved_upload_name );
@@ -478,6 +485,8 @@ class classUpload
 			$this->error_no = 5;
 			return false;
 		}
+
+		
 		# Check against local file-inclusion PHP code
 		//else if( strpos( $file_check, '<' . '?php' ) !== false OR strpos( $file_check, 'eval' ) !== false OR strpos( $file_check, 'base64_decode' ) !== false )
 		//{