themesite

--- themesite/private/themesite.class.php   2014-03-20 14:51:33.484324931 +0100
+++ themesite-new/private/themesite.class.php   2014-03-20 15:46:00.236270202 +0100
@@ -958,7 +958,8 @@
         $rsbsfound = array();
         $cfgfound = array();
         $shortname = '';
-        $cfg = '';
+        $cfg = array();
+        $checkCfgFilenamesAgain = FALSE;

         if (is_int($zip)) {
             $err[] = sprintf("'Couldn't open zipfile %s", $themezipupload['name']);
@@ -995,8 +996,21 @@
             switch(strtolower($pathinfo['extension'])) {
                 case 'cfg':
                     /* Save the contents for later checking */
-                    $cfg = $this->getzipentrycontents($zip, $ze);
+                    $cfg[] = $this->getzipentrycontents($zip, $ze);
                     $cfgfound[] = $filename;
+                    if ($shortname === '') {
+                        // we're gonna need to check cfg filenames again because shortname isn't set yet
+                        $checkCfgFilenamesAgain = TRUE;
+                    } else {
+                        if ($pathinfo['filename'] !== "$shortname") {
+                            if (strpos($pathinfo['filename'], "{$shortname}-") !== 0) {
+                                // filename does not start with shortname-*
+                                $err[] = sprintf('Filename invalid: %s (should be %s.%s or %s-*.%s)', $filename, $shortname, $pathinfo['extension'], $shortname, $pathinfo['extension']);
+                            }
+                        }
+                    }
+                    break;
+
                 case 'sbs':
                 case 'rsbs':
                 case 'wps':
@@ -1046,10 +1060,30 @@
             }
         }

+        // we check cfg filenames a second time in case $shortname wasn't set the first time around
+        if ($checkCfgFilenamesAgain) {
+            while ($ze = zip_read($zip)) {
+                $filename = zip_entry_name($ze);
+                $pathinfo = $this->my_pathinfo($filename);
+                if (strtolower($pathinfo['extension']) == 'cfg') {
+                    if ($shortname === '') {
+                        $shortname = $pathinfo['filename'];
+                    } elseif ($pathinfo['filename'] !== $shortname) {
+                        if (strpos($pathinfo['filename'], "{$shortname}-") !== 0) {
+                            $err[] = sprintf('Filename invalid: %s (should be %s.%s or %s-*.%s)', $filename, $shortname, $pathinfo['extension'], $shortname, $pathinfo['extension']);
+                        }
+                    }
+                }
+            }
+        }
+
         /* Now we check all the things that could be wrong */
-        $error = $this->validatecfg($cfg, $files);
-        if($error != '')
-            $err[] = $error;
+        foreach ($cfg as $cfgcontent) {
+            $error = $this->validatecfg($cfgcontent, $files);
+            if($error != '')
+                $err[] = $error;
+        }
+
         if ($themezipupload['size'] > config::maxzippedsize)
             $err[] = sprintf("Theme zip too large at %s (max size is %s)", $themezipupload['size'], config::maxzippedsize);
         if ($totalsize > config::maxthemesize)
@@ -1062,9 +1096,7 @@
         elseif (count($wpsfound) == 0)
             $err[] = "No .wps files found.";

-        if (count($cfgfound) > 1)
-            $err[] = sprintf("More than one .cfg found (%s).", implode(', ', $cfgfound));
-        elseif (count($cfgfound) == 0)
+        if (count($cfgfound) == 0)
             $err[] = "No .cfg files found.";

         if (count($rwpsfound) > 1)