From caee5c6baf65968dc7cabd10b1eb0689029a0f99 Mon Sep 17 00:00:00 2001
From: Sebastiaan Janssen <sebastiaan@umbraco.com>
Date: Wed, 26 Nov 2014 14:42:24 +0100
Subject: [PATCH] #U4-5889 Fixed Due in version 7.2.0

Cross Site Scripting through umbraco uploader
---
 src/Umbraco.Web.UI/config/umbracoSettings.Release.config | 2 +-
 src/Umbraco.Web.UI/config/umbracoSettings.config         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Umbraco.Web.UI/config/umbracoSettings.Release.config b/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
index 73500c7fe1..96997518e7 100644
--- a/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
+++ b/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
@@ -45,7 +45,7 @@
     <MacroErrors>inline</MacroErrors>
 
     <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
-    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd</disallowedUploadFiles>
+    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf</disallowedUploadFiles>
 
     <!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
     <defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>
diff --git a/src/Umbraco.Web.UI/config/umbracoSettings.config b/src/Umbraco.Web.UI/config/umbracoSettings.config
index edfc853dc4..4c09ed76fd 100644
--- a/src/Umbraco.Web.UI/config/umbracoSettings.config
+++ b/src/Umbraco.Web.UI/config/umbracoSettings.config
@@ -98,7 +98,7 @@
     <MacroErrors>throw</MacroErrors>
     
     <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
-    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd</disallowedUploadFiles>
+    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf</disallowedUploadFiles>
 
     <!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
     <defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>