diff --git a/docs/NEWS b/docs/NEWS index 6ef70a3a..038c8466 100644 --- a/docs/NEWS +++ b/docs/NEWS @@ -1,6 +1,9 @@ Version 2.4-alpha1 () ------------------------------------------------------------------------ + * Fix: Prevent renaming a ML object into an existing file, + resulting in deletion of both from disk and database. + * Fix invalid HTTP referrer error when trying to delete a trackback from the frontend diff --git a/include/functions_images.inc.php b/include/functions_images.inc.php index fc2c5963..32d555ba 100644 --- a/include/functions_images.inc.php +++ b/include/functions_images.inc.php @@ -2260,6 +2260,10 @@ function serendipity_renameFile($id, $newName, $path = null) { $imgBase = $serendipity['serendipityPath'] . $serendipity['uploadPath']; $newPath = "{$imgBase}{$path}{$newName}.{$file['extension']}"; + + if (file_exists($newPath)) { + return false; + } rename("{$imgBase}{$file['path']}{$file['realname']}", $newPath);