Fix so settings/upload.inc could not be used by plugins (#5694)

CHANGELOG

@@ -24,6 +24,7 @@ CHANGELOG Roundcube Webmail
 - Managesieve: Fix possible defect in handling \r\n in scripts (#5685)
 - Fix/rephrase "unsaved changes" warning when cancelling a draft (#5610)
 - Fix XSS issue in handling of a style tag inside of an svg element
+- Fix so settings/upload.inc could not be used by plugins (#5694)
 
 RELEASE 1.3-beta
 ----------------

program/steps/settings/upload.inc

@@ -27,6 +27,11 @@ if (!empty($_GET['_progress'])) {
 $from = rcube_utils::get_input_value('_from', rcube_utils::INPUT_GET);
 $type = preg_replace('/(add|edit)-/', '', $from);
 
+// Plugins in Settings may use this file for some uploads (#5694)
+// Make sure it does not contain a dot, which is a special character
+// when using rcube_session::append() below
+$type = str_replace('.', '-', $type);
+
 if ($RCMAIL->action == 'upload-display') {
     $id = 'undefined';