Merge pull request #943 from Oldiesmann/release-2.1

! Don't allow $boarddir, $sourcedir and $settings['theme_dir'] as attachment directories

Sources/ManageAttachments.php

@@ -1918,7 +1918,7 @@ function ApproveAttachments($attachments)
  */
 function ManageAttachmentPaths()
 {
-	global $modSettings, $scripturl, $context, $txt, $sourcedir, $boarddir, $smcFunc;
+	global $modSettings, $scripturl, $context, $txt, $sourcedir, $boarddir, $smcFunc, $settings;
 
 	// Since this needs to be done eventually.
 	if (!is_array($modSettings['attachmentUploadDir']))
@@ -1944,8 +1944,17 @@ function ManageAttachmentPaths()
 			if ($id < 1)
 				continue;
 
+			// Sorry, these dirs are NOT valid
+			$invalid_dirs = array($boarddir, $settings['default_theme_dir'], $sourcedir);
+			if (in_array($path, $invalid_dirs))
+			{
+				$errors[] = $path . ': ' . $txt['attach_dir_invalid'];
+				continue;
+			}
+
 			// Hmm, a new path maybe?
-			if (!array_key_exists($id, $modSettings['attachmentUploadDir']))
+			// Don't allow empty paths
+			if (!array_key_exists($id, $modSettings['attachmentUploadDir']) && !empty($path))
 			{
 				// or is it?
 				if (in_array($path, $modSettings['attachmentUploadDir']) || in_array($boarddir . DIRECTORY_SEPARATOR . $path, $modSettings['attachmentUploadDir']))
@@ -1953,6 +1962,11 @@ function ManageAttachmentPaths()
 						$errors[] = $path . ': ' . $txt['attach_dir_duplicate_msg'];
 						continue;
 				}
+				elseif (empty($path))
+				{
+					// Ignore this and set $id to one less
+					continue;
+				}
 
 				// OK, so let's try to create it then.
 				require_once($sourcedir . '/Subs-Attachments.php');

Themes/default/languages/Admin.english.php

@@ -386,6 +386,7 @@ $txt['attach_dir_no_delete'] = 'Is not empty and can not be deleted. Please do s
 $txt['attach_dir_no_remove'] = 'Still contains files or is a base directory and can not be deleted.';
 $txt['attach_dir_is_current'] = 'Unable to remove while it is selected as the current directory.';
 $txt['attach_dir_is_current_bd'] = 'Unable to remove while it is selected as the current base directory.';
+$txt['attach_dir_invalid'] = 'Invalid directory';
 $txt['attach_last_dir'] = 'Last active attachment directory';
 $txt['attach_current_dir'] = 'Current attachment directory';
 $txt['attach_current'] = 'Current';