, '"', '<', '>', ' ', "'"), $CONFIG['forbiden_fname_char']);
}
preg_match_all("#$mb_utf8_regex".'|[\x00-\x7F]#', $chars, $forbidden_chars);
}
/**
* $str may also come from $_POST, in this case, all &, ", etc will get replaced with entities.
* Replace them back to normal chars so that the str_replace below can work.
*/
$str = str_replace(array('&', '"', '<', '>'), array('&', '"', '<', '>'), $str);;
$return = str_replace($forbidden_chars[0], '_', $str);
/**
* Fix the obscure, misdocumented "feature" in Apache that causes the server
* to process the last "valid" extension in the filename (rar exploit): replace all
* dots in the filename except the last one with an underscore.
*/
// This could be concatenated into a more efficient string later, keeping it in three
// lines for better readability for now.
$extension = ltrim(substr($return,strrpos($return,'.')),'.');
$filenameWithoutExtension = str_replace('.' . $extension, '', $return);
$return = str_replace('.', '_', $filenameWithoutExtension) . '.' . $extension;
return $return;
}
/**
* resetDetailHits()
*
* Reset the detailed hits stored in hit_stats table for the given pid
*
* @param int or array $pid
**/
function resetDetailHits($pid)
{
global $CONFIG;
if (is_array($pid)) {
if (!count($pid)) {
return;
} else {
$clause = "pid IN (".implode(',', $pid).")";
}
} else {
$clause = "pid = '$pid'";
}
$query = "DELETE FROM {$CONFIG['TABLE_HIT_STATS']} WHERE $clause";
cpg_db_query($query);
}
/**
* resetDetailVotes()
*
* Reset the detailed votes stored in vote_stats table for the given pid
*
* @param int or array $pid
**/
function resetDetailVotes($pid)
{
global $CONFIG;
if (is_array($pid)) {
if (!count($pid)) {
return;
} else {
$clause = "pid IN (".implode(',', $pid).")";
}
} else {
$clause = "pid = '$pid'";
}
$query = "DELETE FROM {$CONFIG['TABLE_VOTE_STATS']} WHERE $clause";
cpg_db_query($query);
}
?>