[eluser]Derek Jones[/eluser]
A fix has been implemented for a security flaw in CodeIgniter 1.7.2. You may obtain the fix either by <a href="http://codeigniter.com/download.php">downloading</a> a fresh copy of CodeIgniter, or downloading this <a href="/download_files/CI_1.7.2_201007_sec_patch.zip">standalone patch</a>. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability.
While fixing this bug, we took the opportunity to make an improvement to the Upload class's ability to allow a file name override. Previously, you needed to do a little dance in your controller to remove the extension from the file name if you were starting from user input; neither could you override the file extension. Now when using the "file_name" config override, you will supply the full file name, including the extension, truly overriding the file name provided by the client user agent.
After applying the patch, you will need to adjust your code accordingly if you are using the 'file_name' override in the Upload class. While we are not in the habit of making code changes within a version that has the potential to break compatibility, this change was necessary as part of the security fix.
If you are using CodeIgniter from the Mercurial repository at <a href="http://bitbucket.org/ellislab/codeigniter/">BitBucket</a>, please make sure you pull the latest files. Version 1.7.2 has been branched and retagged to include this fix.
We'd like to thank CodeIgniter user <a href="http://ellislab.com/forums/member/139514/">alexaholic</a> for bringing this to our attention. Security is always a top priority for our products, and we make ourselves available to be directly contacted for any security concerns.
