some preparations for 1.0.2: bump version

reported by Ke4roh
fix contributed by ?? with suggestion from DavidClaughton

CREDITS

@@ -0,0 +1,19 @@
+
+Users which contributed patches added to versions after 1.0:
+
+* BrianHunter
+* Christoph Berg (cb@df7cb.de)
+* CliffordAdams
+* DavidClaughton
+* DavidWall
+* GyPark
+* MikeCastle
+* RichardP
+* Robin Rowe (rower@movieeditor.com)
+* TomScanlan
+* Trent
+* UngarPeter
+
+If I've forgotten someone, please leave a note on UseMod:MarkusLude or
+send mail to usemod@usemod.com.
+

Changelog

@@ -0,0 +1,43 @@
+
+Changes for bugfix release 1.0.2 (August 26, 2007):
+
+* added CREDITS and Changelog (forgot them in 1.0.1)
+* make .zip distribution for Windows users again (forgot it for 1.0.1)
+* fixed range in SplitUrlPunct()
+* fixed bug ActionEqIndexAndEmbedEqOne
+  same problem with other actions and parameter embed
+* moved CSS class wikilinefooter (for <hr>) inside class wikifooter
+* fixed bug ClassWikifooterMissing
+* fixed bug VariableParseParasYieldsOddOutput
+  fix contributed by Trent, simplified
+* fixed bug UploadTranslation
+  fix contributed by UngarPeter
+* added patch RobotsNoFollow version D
+  contributed by Trent with suggestion by UngarPeter
+  based on work by TomScanlan
+* fixed bug ActionLinksExistsZeroSubPage aka RequestedLinks
+  based on fix by GyPark and MikeCastle
+* fixed bug ImageExtensionsCaseSensitive aka
+  UppercaseImageUploadCausesProblemsWithDisplay
+* added ico/tif/tiff to ImageExtensions
+* fixed bug CamelCaseImageUploadCausesProblemsWithDisplay
+  with suggestion from DavidClaughton
+
+Changes for bugfix release 1.0.1 (July 9, 2007):
+
+* SECURITY: fix cross-site scripting vulnerability (CVE-2004-1397)
+  fix contributed by Christoph Berg (cb@df7cb.de)
+* fixed bug PossibleToCreatePagesThatCanNotBeEdited
+  fix contributed by RichardP
+* fixed bug FileUploadManglesFile aka Win32BinaryUpload aka
+  UploadOnWindowsNeedsBinmode
+  fix contributed by Robin Rowe (rower@movieeditor.com) and DavidWall
+* fixed bug CompareButtonFailsToDiff aka DoHistory's_Form
+  fix contributed by BrianHunter and ??
+* fixed bug BadHtml
+* fixed bug AmpersandBug
+  fix contributed by UngarPeter
+
+If I've forgotten something or someone, please leave a note on
+UseMod:MarkusLude or send mail to usemod@usemod.com.
+

README

@@ -1,5 +1,5 @@
-README for UseModWiki 1.0
-Last updated: August 1, 2003
+README for UseModWiki 1.0.2
+Last updated: August 26, 2007
 
 Release notes:
 

config

@@ -1,5 +1,5 @@
 # == Configuration =======================================================
-# Original version from UseModWiki 1.0
+# Original version from UseModWiki 1.0.2
 
 $CookieName  = "Wiki";          # Name for this wiki (for multi-wiki sites)
 $SiteName    = "Wiki";          # Name of site (used for titles)

misc/trans.pl

@@ -487,6 +487,8 @@ The current upload size limit is %s.
 
 Change the %s variable to increase this limit.
 
+File to Upload:
+
 Upload Finished
 
 The wiki link to your file is:

wiki.pl

@@ -1,5 +1,5 @@
 #!/usr/bin/perl
-# UseModWiki version 1.0 (September 12, 2003)
+# UseModWiki version 1.0.2 (August 26, 2007)
 # Copyright (C) 2000-2003 Clifford A. Adams  <caadams@usemod.com>
 # Copyright (C) 2002-2003 Sunir Shah  <sunir@sunir.org>
 # Based on the GPLed AtisWiki 0.3  (C) 1998 Markus Denker
@@ -149,7 +149,7 @@ $UseAmPm      = 1;      # 1 = use am/pm in times, 0 = use 24-hour times
 $UseIndex     = 0;      # 1 = use index file,     0 = slow/reliable method
 $UseHeadings  = 1;      # 1 = allow = h1 text =,  0 = no header formatting
 $NetworkFile  = 1;      # 1 = allow remote file:, 0 = no file:// links
-$BracketWiki  = 0;	# 1 = [WikiLnk txt] link, 0 = no local descriptions
+$BracketWiki  = 0;      # 1 = [WikiLnk txt] link, 0 = no local descriptions
 $UseLookup    = 1;      # 1 = lookup host names,  0 = skip lookup (IP only)
 $FreeUpper    = 1;      # 1 = force upper case,   0 = do not force case
 $FastGlob     = 1;      # 1 = new faster code,    0 = old compatible code
@@ -317,7 +317,7 @@ sub InitLinkPatterns {
                   . "prospero|telnet|gopher";
   $UrlProtocols .= '|file'  if ($NetworkFile || !$LimitFileUrl);
   $UrlPattern = "((?:(?:$UrlProtocols):[^\\]\\s\"<>$FS]+)$QDelim)";
-  $ImageExtensions = "(gif|jpg|png|bmp|jpeg)";
+  $ImageExtensions = "(gif|jpg|png|bmp|jpeg|ico|tiff?)";
   $RFCPattern = "RFC\\s?(\\d+)";
   $ISBNPattern = "ISBN:?([0-9- xX]{10,})";
   $UploadPattern = "upload:([^\\]\\s\"<>$FS]+)$QDelim";
@@ -374,18 +374,23 @@ sub T {
 }
 
 sub Ts {
-  my ($text, $string) = @_;
+  my ($text, $string, $noquote) = @_;
 
+  $string = &QuoteHtml($string) unless $noquote;
   $text = T($text);
   $text =~ s/\%s/$string/;
   return $text;
 }
 
 sub Tss {
-  my $text = @_[0];
+  my $text = $_[0];
+  my @args = @_;
 
+  @args = map {
+    $_ = &QuoteHtml($_);
+  } @args;
   $text = T($text);
-  $text =~ s/\%([1-9])/$_[$1]/ge;
+  $text =~ s/\%([1-9])/$args[$1]/ge;
   return $text;
 }
 
@@ -571,15 +576,12 @@ sub BrowsePage {
   $fullHtml .= '<div class=wikitext>';
   $fullHtml .= &WikiToHTML($Text{'text'});
   $fullHtml .= '</div>';
-  if (!&GetParam('embed', $EmbedWiki)) {
-    $fullHtml .= "<hr class=wikilinefooter>\n";
-  }
   if (($id eq $RCName) || (T($RCName) eq $id) || (T($id) eq $RCName)) {
     print $fullHtml;
+    print "<hr class=wikilinerc>\n";
     print '<div class=wikirc>';
     &DoRc(1);
     print '</div>';
-    print "<hr class=wikilinefooter>\n"  if (!&GetParam('embed', $EmbedWiki));
     print &GetFooterText($id, $goodRevision);
     return;
   }
@@ -993,11 +995,11 @@ sub DoHistory {
   $canEdit = &UserCanEdit($id)  if ($HistoryEdit);
   if ($UseDiff) {
     print <<EOF ;
-      <form action='$ScriptName' METHOD='GET'>
-          <input type='hidden' name='action' value='browse'/>
-          <input type='hidden' name='diff' value='1'/>
-          <input type='hidden' name='id' value='$id'/>
-      <table border='0' width='100%'><tr>
+      <form action="$ScriptName" METHOD="GET">
+          <input type="hidden" name="action" value="browse"/>
+          <input type="hidden" name="diff" value="1"/>
+          <input type="hidden" name="id" value="$id"/>
+      <table border="0" width="100%"><tr>
 EOF
   }
   $html = &GetHistoryLine($id, $Page{'text_default'}, $canEdit, $row++);
@@ -1093,14 +1095,15 @@ sub ScriptLinkChar {
 sub ScriptLink {
   my ($action, $text) = @_;
 
-  return "<a href=\"$ScriptName" . &ScriptLinkChar() . "$action\">$text</a>";
+  return '<a href="' . $ScriptName . &ScriptLinkChar() . &UriEscape($action)
+         . "\">$text</a>";
 }
 
 sub ScriptLinkClass {
   my ($action, $text, $class) = @_;
 
-  return "<a href=\"$ScriptName" . &ScriptLinkChar() . "$action\""
-         . ' class=' . $class . ">$text</a>";
+  return '<a href="' . $ScriptName . &ScriptLinkChar() . &UriEscape($action)
+         . '" class="' . $class . "\">$text</a>";
 }
 
 sub GetPageLinkText {
@@ -1245,8 +1248,8 @@ sub ScriptLinkTitle {
   if ($FreeLinks) {
     $action =~ s/ /_/g;
   }
-  return "<a href=\"$ScriptName" . &ScriptLinkChar()
-         . "$action\" title=\"$title\">$text</a>";
+  return '<a href="' . $ScriptName . &ScriptLinkChar() . &UriEscape($action)
+         . "\" title=\"$title\">$text</a>";
 }
 
 sub GetAuthorLink {
@@ -1297,7 +1300,7 @@ sub GetHeader {
   $result .= '<div class=wikiheader>';
   if ($oldId ne '') {
     $result .= $q->h3('(' . Ts('redirected from %s', 
-                               &GetEditLink($oldId, $oldId)) . ')');
+                               &GetEditLink($oldId, $oldId), 1) . ')');
   }
   if ((!$embed) && ($LogoUrl ne "")) {
     $logoImage = "img src=\"$LogoUrl\" alt=\"$altText\" border=0";
@@ -1358,6 +1361,11 @@ sub GetHtmlHeader {
       $keywords =~ s/([a-z])([A-Z])/$1, $2/g;
       $html .= "<META NAME='KEYWORDS' CONTENT='$keywords'/>\n" if $keywords;
   }
+  # we don't want robots indexing our history or other admin pages
+  my $action = lc(&GetParam('action', ''));
+  unless (!$action or $action eq "rc" or $action eq "index") {
+    $html .= "<META NAME='robots' CONTENT='noindex,nofollow'>\n";
+  }
   if ($SiteBase ne "") {
     $html .= qq(<BASE HREF="$SiteBase">\n);
   }
@@ -1387,6 +1395,7 @@ sub GetFooterText {
     return $q->end_html;
   }
   $result = '<div class=wikifooter>';
+  $result .= "<hr class=wikilinefooter>\n";
   $result .= &GetFormStart();
   $result .= &GetGotoBar($id);
   if (&UserCanEdit($id, 0)) {
@@ -1406,7 +1415,7 @@ sub GetFooterText {
     $result .= &GetPageLinkText($id, T('View current revision'));
   }
   if ($UseMetaWiki) {
-    $result .= ' | <a href="http://sunir.org/apps/meta.pl?' . $id . '">'
+    $result .= ' | <a href="http://sunir.org/apps/meta.pl?' . &UriEscape($id) . '">'
                . T('Search MetaWiki') . '</a>';
   }
   if ($Section{'revision'} > 0) {
@@ -1419,7 +1428,7 @@ sub GetFooterText {
     $result .= ' ' . &TimeToText($Section{ts});
     if ($AuthorFooter) {
       $result .= ' ' . Ts('by %s', &GetAuthorLink($Section{'host'},
-                                     $Section{'username'}, $Section{'id'}));
+                                     $Section{'username'}, $Section{'id'}), 1);
     }
   }
   if ($UseDiff) {
@@ -1450,7 +1459,7 @@ sub GetFooterText {
 sub GetCommonFooter {
   my ($html);
 
-  $html = '<hr class=wikilinefooter>' . '<div class=wikifooter>'
+  $html = '<div class=wikifooter>' . '<hr class=wikilinefooter>'
           . &GetFormStart() . &GetGotoBar('')
           . &GetSearchForm() . $q->endform;
   if ($FooterNote ne '') {
@@ -1513,7 +1522,7 @@ sub GetRedirectPage {
 
   # Normally get URL from script, but allow override.
   $FullUrl = $q->url(-full=>1)  if ($FullUrl eq "");
-  $url = $FullUrl . &ScriptLinkChar() . $newid;
+  $url = $FullUrl . &ScriptLinkChar() . &UriEscape($newid);
   $nameLink = "<a href=\"$url\">$name</a>";
   if ($RedirType < 3) {
     if ($RedirType == 1) {             # Use CGI.pm
@@ -1581,7 +1590,7 @@ sub WikiToHTML {
         s/\&lt;pre\&gt;((.|\n)*?)\&lt;\/pre\&gt;/&StorePre($1, "pre")/ige;
     $pageText =~
         s/\&lt;code\&gt;((.|\n)*?)\&lt;\/code\&gt;/&StorePre($1, "code")/ige;
-    $pageText =~ s/((.|\n)+?\n)\s*\n/&ParseParagraph($1)/geo;
+    $pageText =~ s/((.|\n)+?\n)\s*(\n|$)/&ParseParagraph($1)/geo;
     $pageText =~ s/(.*)<\/p>(.+)$/$1.&ParseParagraph($2)/seo;
   } else {
     $pageText = &CommonMarkup($pageText, 1, 0);   # Multi-line markup
@@ -1652,6 +1661,9 @@ sub CommonMarkup {
     s/\[$InterLinkPattern\]/&StoreBracketInterPage($1, "", 0)/geo;
     s/\b$UrlPattern/&StoreUrl($1, $useImage)/geo;
     s/\b$InterLinkPattern/&StoreInterPage($1, $useImage)/geo;
+    if ($UseUpload) {
+      s/$UploadPattern/&StoreUpload($1)/geo;
+    }
     if ($WikiLinks) {
       s/$AnchoredLinkPattern/&StoreRaw(&GetPageOrEditAnchoredLink($1,
                              $2, ""))/geo if $NamedAnchors;
@@ -1661,9 +1673,6 @@ sub CommonMarkup {
     }
     s/\b$RFCPattern/&StoreRFC($1)/geo;
     s/\b$ISBNPattern/&StoreISBN($1)/geo;
-    if ($UseUpload) {
-      s/$UploadPattern/&StoreUpload($1)/geo;
-    }
     if ($ThinLine) {
       if ($OldThinLine) {  # Backwards compatible, conflicts with headers
         s/====+/<hr noshade class=wikiline size=2>/g;
@@ -1782,6 +1791,13 @@ sub EvalLocalRules {
   return $text;
 }
  
+sub UriEscape {
+  my ($uri) = @_;
+  $uri =~ s/([\x00-\x1f\x7f-\xff])/sprintf("%%%02X", ord($1))/ge;
+  $uri =~ s/\&/\&amp;/g;
+  return $uri;
+}
+
 sub QuoteHtml {
   my ($html) = @_;
 
@@ -1941,7 +1957,7 @@ sub ImageAllowed {
 
   $imagePrefixes = 'http:|https:|ftp:';
   $imagePrefixes .= '|file:'  if (!$LimitFileUrl);
-  return 0  unless ($url =~ /^($imagePrefixes).+\.$ImageExtensions$/);
+  return 0  unless ($url =~ /^($imagePrefixes).+\.$ImageExtensions$/i);
   return 0  if ($url =~ /"/);      # No HTML-breaking quotes allowed
   return 1  if (@ImageSites < 1);  # Most common case: () means all allowed
   return 0  if ($ImageSites[0] eq 'none');  # Special case: none allowed
@@ -2076,7 +2092,7 @@ sub SplitUrlPunct {
   $punct = "";
   if ($NewFS) {
     ($punct) = ($url =~ /([^a-zA-Z0-9\/\x80-\xff]+)$/);
-    $url =~ s/([^a-zA-Z0-9\/\xc0-\xff]+)$//;
+    $url =~ s/([^a-zA-Z0-9\/\x80-\xff]+)$//;
   } else {
     ($punct) = ($url =~ /([^a-zA-Z0-9\/\xc0-\xff]+)$/);
     $url =~ s/([^a-zA-Z0-9\/\xc0-\xff]+)$//;
@@ -2599,7 +2615,7 @@ sub UserDataFilename {
 sub ReportError {
   my ($errmsg) = @_;
 
-  print $q->header, "<H2>", $errmsg, "</H2>", $q->end_html;
+  print $q->header, $q->start_html, "<H2>", &QuoteHtml($errmsg), "</H2>", $q->end_html;
 }
 
 sub ValidId {
@@ -3276,7 +3292,7 @@ sub DoEdit {
     print ' (', T('Your user name is'), ' ',
           &GetPageLink($userName) . ') ';
   } else {
-    print ' (', Ts('Visit %s to set your user name.', &GetPrefsLink()), ') ';
+    print ' (', Ts('Visit %s to set your user name.', &GetPrefsLink(), 1), ') ';
   }
   print $q->submit(-name=>'Preview', -value=>T('Preview')), "\n";
   if ($isConflict) {
@@ -3285,9 +3301,9 @@ sub DoEdit {
           &GetTextArea('newtext', $newText, $editRows, $editCols),
           "<p>\n";
   }
-  print "<hr class=wikilinefooter>\n";
   if ($preview) {
     print '<div class=wikipreview>';
+    print "<hr class=wikilinepreview>\n";
     print "<h2>", T('Preview:'), "</h2>\n";
     if ($isConflict) {
       print "<b>",
@@ -3296,15 +3312,18 @@ sub DoEdit {
     }
     $MainPage = $id;
     $MainPage =~ s|/.*||;  # Only the main page name (remove subpage)
-    print &WikiToHTML($oldText) . "<hr class=wikilinefooter>\n";
+    print &WikiToHTML($oldText) . "<hr class=wikilinepreview>\n";
     print "<h2>", T('Preview only, not yet saved'), "</h2>\n";
     print '</div>';
   }
-  print '<div class=wikifooter>';
-  print &GetHistoryLink($id, T('View other revisions')) . "<br>\n";
-  print &GetGotoBar($id);
   print $q->endform;
-  print '</div>';
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetHistoryLink($id, T('View other revisions')) . "<br>\n";
+    print &GetGotoBar($id);
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -3403,12 +3422,14 @@ sub DoEditPrefs {
   print '<br>' . T('StyleSheet URL:') . ' ',
         &GetFormText('stylesheet', "", 30, 150);
   print '<br>', $q->submit(-name=>'Save', -value=>T('Save')), "\n";
-  print '</div>';
-  print "<hr class=wikilinefooter>\n";
-  print '<div class=wikifooter>';
-  print &GetGotoBar('');
   print $q->endform;
   print '</div>';
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetGotoBar('');
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -3627,9 +3648,13 @@ sub DoEnterLogin {
         $q->password_field(-name=>'p_password', -value=>'', 
                            -size=>15, -maxlength=>50);
   print '<br>', $q->submit(-name=>'Login', -value=>T('Login')), "\n";
-  print "<hr class=wikilinefooter>\n";
-  print &GetGotoBar('');
   print $q->endform;
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetGotoBar('');
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -3659,9 +3684,12 @@ sub DoLogin {
   } else {
     print Ts('Login for user ID %s failed.', $uid);
   }
-  print "<hr class=wikilinefooter>\n";
-  print &GetGotoBar('');
-  print $q->endform;
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetGotoBar('');
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -3795,7 +3823,7 @@ sub PrintLinkList {
 sub GetFullLinkList {
   my ($name, $unique, $sort, $exists, $empty, $link, $search);
   my ($pagelink, $interlink, $urllink);
-  my (@found, @links, @newlinks, @pglist, %pgExists, %seen);
+  my (@found, @links, @newlinks, @pglist, %pgExists, %seen, $main);
 
   $unique = &GetParam("unique", 1);
   $sort = &GetParam("sort", 1);
@@ -3820,7 +3848,14 @@ sub GetFullLinkList {
       %seen = ();
     }
     @links = &GetPageLinks($name, $pagelink, $interlink, $urllink);
+    if ($UseSubpage) {
+      $main = $name;
+      $main =~ s/\/.*//;
+    }
     foreach $link (@links) {
+      if ($UseSubpage && ($link =~ /^\//)) {
+        $link = $main . $link;
+      }
       $seen{$link}++;
       if (($unique > 0) && ($seen{$link} != 1)) {
         next;
@@ -3896,6 +3931,9 @@ sub DoPost {
   my $editTime = $Now;
   my $authorAddr = $ENV{REMOTE_ADDR};
 
+  if ($FreeLinks) {
+    $id = &FreeToNormal($id);
+  }
   if (!&UserCanEdit($id, 1)) {
     # This is an internal interface--we don't need to explain
     &ReportError(Ts('Editing not allowed for %s.', $id));
@@ -4070,7 +4108,7 @@ sub EmailNotify {
     $address =~ s/\n//g;
     close(EMAIL);
     my $home_url = $q->url();
-    my $page_url = $home_url . "?$id";
+    my $page_url = $home_url . &ScriptLinkChar() . &UriEscape($id);
     my $editors_summary = $q->param("summary");
     if (($editors_summary eq "*") or ($editors_summary eq "")){
       $editors_summary = "";
@@ -4419,9 +4457,13 @@ sub DoEditBanned {
         "^123\\.21\\.3\\.\\d+\$<p>";
   print &GetTextArea('banlist', $banList, 12, 50);
   print "<br>", $q->submit(-name=>'Save'), "\n";
-  print "<hr class=wikilinefooter>\n";
-  print &GetGotoBar("");
   print $q->endform;
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetGotoBar('');
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -4471,9 +4513,13 @@ sub DoEditLinks {
   print $q->checkbox(-name=>"p_changetext", -override=>1, -checked=>1,
                       -label=>"Substitute text for rename");
   print "<br>", $q->submit(-name=>'Edit'), "\n";
-  print "<hr class=wikilinefooter>\n";
-  print &GetGotoBar("");
   print $q->endform;
+  if (!&GetParam('embed', $EmbedWiki)) {
+    print '<div class=wikifooter>';
+    print "<hr class=wikilinefooter>\n";
+    print &GetGotoBar('');
+    print '</div>';
+  }
   print &GetMinimumFooter();
 }
 
@@ -4828,7 +4874,7 @@ sub RenamePage {
 
 sub DoShowVersion {
   print &GetHeader("", "Displaying Wiki Version", "");
-  print "<p>UseModWiki version 1.0</p>\n";
+  print "<p>UseModWiki version 1.0.2</p>\n";
   print &GetCommonFooter();
 }
 
@@ -4911,8 +4957,8 @@ sub DoUpload {
   print '<FORM METHOD="post" ACTION="' . $ScriptName
         . '" ENCTYPE="multipart/form-data">';
   print '<input type="hidden" name="upload" value="1" />';
-  print 'File to Upload: <INPUT TYPE="file" NAME="file"><br><BR>';
-  print '<INPUT TYPE="submit" NAME="Submit" VALUE="Upload">';
+  print T('File to Upload:'), ' <INPUT TYPE="file" NAME="file"><br><BR>';
+  print '<INPUT TYPE="submit" NAME="Submit" VALUE="', T('Upload'), '">';
   print '</FORM>';
   print &GetCommonFooter(); 
 }
@@ -4930,13 +4976,14 @@ sub SaveUpload {
   $filename =~ s/.*[\/\\](.*)/$1/;  # Only name after last \ or /
   $uploadFilehandle = $q->upload('file');
   open UPLOADFILE, ">$UploadDir$filename";
+  binmode UPLOADFILE;
   while (<$uploadFilehandle>) { print UPLOADFILE; }
   close UPLOADFILE;
   print T('The wiki link to your file is:') . "\n<br><BR>";
   $printFilename = $filename;
   $printFilename =~ s/ /\%20/g;  # Replace spaces with escaped spaces
   print "upload:" . $printFilename . "<BR><BR>\n";
-  if ($filename =~ /${ImageExtensions}$/) {
+  if ($filename =~ /$ImageExtensions$/i) {
     print '<HR><img src="' . $UploadUrl . $filename . '">' . "\n";
   }
   print &GetCommonFooter();