The following list of files I am trying to upload have encountered with a "Forbidden Filename" error.
In the "data" folder
archives
auto_archive.db.php
backup
captcha.php
cat.num.php
category.db.php
comments.txt
config.php
Default.tpl
emoticons
english.clf
flood.db.php
Headlines.tpl
index.html
ipban.db.php
log.db.php
loginban.db.php
news.txt
postponed_news.txt
rss.tpl
rss_config.php
unapproved_news.txt
upimages
users.db.php
In the "archives" folder:
index.html
In the "backup" folder:
index.html
In the "emoticons" folder:
angry.gif
crying.gif
index.html
laughing.gif
sad.gif
smile.gif
tongue.gif
wassat.gif
wink.gif
In the "upimages" folder:
cutenews-banner.gif
index.html
All of these files are from a script called
UTF-8 Cutenews which I have managed to successfully upload previously whenever I need to reinstall this script. I'm shocked even files like index.html are considered "forbidden".
To my curiosity, I decided to test another theory by uploading some files from a PHP template library called
Smarty. I noticed that even modifier.date_format.php and function.html_select_date.php are blocked.
While I agree for the need for filtering based on your needs, I agree with this
guy that you may be a little bit to aggressive in filtering.
Thanks.