Sanitized company logo name while saving.

modules/Settings/Vtiger/actions/CompanyDetailsSave.php

@@ -17,14 +17,17 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac
 		$status = false;
 
         if ($request->get('organizationname')) {
-            $saveLogo = $status = true;
+			$saveLogo = $status = true;
+			$binFileName = false;
 			if(!empty($_FILES['logo']['name'])) {
 				$logoDetails = $_FILES['logo'];
 				$saveLogo = Vtiger_Functions::validateImage($logoDetails);
 				if (is_string($saveLogo)) $saveLogo = ($saveLogo == 'false')? false : true;
 
+				global $upload_badext;
+				$binFileName = sanitizeUploadFileName($logoDetails['name'], $upload_badext);
                 if ($saveLogo) {
-                    $moduleModel->saveLogo();
+                    $moduleModel->saveLogo($binFileName);
                 }
             }else{
                 $saveLogo = true;
@@ -33,8 +36,8 @@ class Settings_Vtiger_CompanyDetailsSave_Action extends Settings_Vtiger_Basic_Ac
 			foreach ($fields as $fieldName => $fieldType) {
 				$fieldValue = $request->get($fieldName);
 				if ($fieldName === 'logoname') {
-					if (!empty($logoDetails['name'])) {
-						$fieldValue = ltrim(basename(" " . $logoDetails['name']));
+					if (!empty($logoDetails['name']) && $binFileName) {
+						$fieldValue = ltrim(basename(" " . $binFileName));
 					} else {
 						$fieldValue = $moduleModel->get($fieldName);
 					}

modules/Settings/Vtiger/models/CompanyDetails.php

@@ -89,11 +89,13 @@ class Settings_Vtiger_CompanyDetails_Model extends Settings_Vtiger_Module_Model
 	/**
 	 * Function to save the logoinfo
 	 */
-	public function saveLogo() {
-		$uploadDir = vglobal('root_directory'). '/' .$this->logoPath;
-		$logoName = $uploadDir.$_FILES["logo"]["name"];
-		move_uploaded_file($_FILES["logo"]["tmp_name"], $logoName);
-		copy($logoName, $uploadDir.'application.ico');
+	public function saveLogo($binFileName) {
+		if ($binFileName) {
+			$uploadDir = vglobal('root_directory'). '/' .$this->logoPath;
+			$logoName = $uploadDir.$binFileName;
+			move_uploaded_file($_FILES["logo"]["tmp_name"], $logoName);
+			copy($logoName, $uploadDir.'application.ico');
+		}
 	}
 
 	/**
@@ -165,4 +167,4 @@ class Settings_Vtiger_CompanyDetails_Model extends Settings_Vtiger_Module_Model
             } 
             return self::$settings[$fieldname]; 
        } 
-}
\ No newline at end of file
+}