From 16db81cb6ef21ef57c435e3160d0c3397c7eb70a Mon Sep 17 00:00:00 2001
From: Bozhidar Slaveykov <bobi@microweber.com>
Date: Fri, 3 Jun 2022 18:44:26 +0300
Subject: [PATCH] update

---
 userfiles/modules/files/admin_backend.php | 5 ++++-
 userfiles/modules/files/files_admin.js    | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/userfiles/modules/files/admin_backend.php b/userfiles/modules/files/admin_backend.php
index bbefd94e6d8..b7c73cbd9be 100644
--- a/userfiles/modules/files/admin_backend.php
+++ b/userfiles/modules/files/admin_backend.php
@@ -342,7 +342,10 @@
 
     </style>
 
-    <script>mw.require("<?php print $config['url_to_module']; ?>/files_admin.js"); </script>
+    <script>
+        MEDIA_UPLOADS_URL = '<?php echo media_uploads_url(); ?>';
+        mw.require("<?php print $config['url_to_module']; ?>/files_admin.js");
+    </script>
 
     <script type="text/javascript">
         gchecked = function () {
diff --git a/userfiles/modules/files/files_admin.js b/userfiles/modules/files/files_admin.js
index d0fed755273..5e0c42e8a25 100644
--- a/userfiles/modules/files/files_admin.js
+++ b/userfiles/modules/files/files_admin.js
@@ -76,6 +76,12 @@ if (self === parent) {
 
         pval = filterXSS(pval);
 
+        var checkUrlIsCorrect = pval.indexOf(MEDIA_UPLOADS_URL);
+        if (checkUrlIsCorrect !== 0) {
+            mw.notification.error('Wrong media file.');
+            return false;
+        }
+
         if (pval.valueOf()) {
             var type = pval.valueOf().split(".").pop();
             type = type.toLowerCase();