Merge remote-tracking branch 'upstream/4.4-dev' into 5.2-dev-upmerge-2025-04-03

Author: richard67

libraries/src/User/User.php

@@ -771,6 +771,11 @@ public function save($updateOnly = false)
                 }
             }
 
+            // Unset the activation token, if the mail address changes - that affects both, activation and PW resets
+            if ($this->email !== $oldUser->email && $this->id !== 0 && !empty($this->activation) && !$this->block) {
+                $table->activation = '';
+            }
+
             // Fire the onUserBeforeSave event.
             $dispatcher = Factory::getApplication()->getDispatcher();
             PluginHelper::importPlugin('user', null, true, $dispatcher);

plugins/filesystem/local/src/Adapter/LocalAdapter.php

@@ -520,6 +520,10 @@ private function copyFile(string $sourcePath, string $destinationPath, bool $for
             throw new \Exception(Text::_('COM_MEDIA_MOVE_FILE_EXTENSION_INVALID'));
         }
 
+        if (!MediaHelper::checkFileExtension(pathinfo($destinationPath, PATHINFO_EXTENSION))) {
+            throw new \Exception(Text::_('COM_MEDIA_MOVE_FILE_EXTENSION_INVALID'));
+        }
+
         if (file_exists($destinationPath) && !$force) {
             throw new \Exception(Text::_('COM_MEDIA_COPY_FILE_NOT_POSSIBLE_FILE_ALREADY_EXISTS'));
         }