Just ran into this. May need this in more than just this one place, but needed quick fix.
Running v2.6.7
In: administrator/components/com_k2/models/item.php
file is stored in DB with full path eg: /var/www/html/... ($attachment->filename)
then $savepath is being prepended to it.
Line 1066:
Before:
$file = $savepath.DS.$attachment->filename;
After: (make sure we stay in JPATH_ROOT to avoid pulling system files)
$file = $attachment->filename;
if (strpos($file, JPATH_ROOT) !== 0) {
$file = $savepath.DS.$attachment->filename;
}
Added to Issue tracker:
code.google.com/p/getk2/issues/detail?id=624
