learning-unlimited/ESP-Website — pull request #587 by uakfdotb (2013-02-17 03:02:24+00:00)
Title: Security fix: uploaded files are renamed into hashed filename.

This solves unrestricted file upload vulnerability with the Media system (for example, by uploading a class document ending in .php).

Uploaded files are renamed to a hash of their generated URL (which includes the date and the filename; for class documents the class ID is prepended) before saving. When downloading, a response is used that includes file content but also the original filename so that it saves properly.