Detailed update:
Through careful stepping, I have determined that it is the following section in function_upload.asp (lines 557-568) where blnExtensionOK is getting set to false
(I changed the code to set it to TRUE if there was disallowed html and pdf and word files would upload).
'If the file type is an image do some futher checking
ElseIf strExtension <> ".gif" OR strExtension <> ".jpg" OR strExtension <> ".png" OR strExtension <> ".jpeg" OR strExtension <> ".jpe" OR strExtension <> ".tiff" OR strExtension <> ".bmp" Then
'Loop through the array of disallowed HTML tags
For lngLoopCounter = LBound(saryUnSafeHTMLtags) To UBound(saryUnSafeHTMLtags)
'If the disallowed HTML is found remove it and start over
If Instr(1, strTempFile, saryUnSafeHTMLtags(lngLoopCounter), 1) <> 0 Then
blnExtensionOK = False
End If
Next
End If
With the False above changed to True, all file extensions will upload!
Obviously the False is not a typo, but I think the wrong type of files are being scanned in this section.
QUESTION: The comment on this section of code implies it is doing extra checking if it is an image type, but then it only looks for files WITHOUT standard image extensions.
Should all the "<>" be "=" ??????
Edited by Apps4Me - 27 January 2008 at 2:47am