From 23f5bd943cf3db661e60a8d9a5dd047d5f064808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cyril=20Rez=C3=A9?= <me@cyrez.dev>
Date: Mon, 22 Jun 2026 15:48:13 +0200
Subject: [PATCH 1/2] Refactor get method by removing filter parameter

Removed the filter parameter from the get method and updated the return information.
---
 src/Files.php | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/Files.php b/src/Files.php
index 23eee84d..e1260e5c 100644
--- a/src/Files.php
+++ b/src/Files.php
@@ -43,14 +43,12 @@ public function __construct($source = null, array $options = [])
      *
      * @param   string  $name     The name of the input property (usually the name of the files INPUT tag) to get.
      * @param   mixed   $default  The default value to return if the named property does not exist.
-     * @param   string  $filter   The filter to apply to the value.
      *
-     * @return  mixed  The filtered input value.
+     * @return  mixed  The input value.
      *
-     * @see     \Joomla\Filter\InputFilter::clean()
      * @since   1.0
      */
-    public function get($name, $default = null, $filter = 'cmd')
+    public function get($name, $default = null)
     {
         if (isset($this->data[$name])) {
             $results = $this->decodeData(

From 9632cc7010025eb01e30aa671aa225997d2cad25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cyril=20Rez=C3=A9?= <me@cyrez.dev>
Date: Mon, 22 Jun 2026 17:32:00 +0200
Subject: [PATCH 2/2] Enhance get method with filtering capability

Added a filter parameter to the get method to allow filtering of input values.
---
 src/Files.php | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/Files.php b/src/Files.php
index e1260e5c..b634c344 100644
--- a/src/Files.php
+++ b/src/Files.php
@@ -9,6 +9,8 @@
 
 namespace Joomla\Input;
 
+use Joomla\Filter\InputFilter;
+
 /**
  * Joomla! Input Files Class
  *
@@ -43,12 +45,14 @@ public function __construct($source = null, array $options = [])
      *
      * @param   string  $name     The name of the input property (usually the name of the files INPUT tag) to get.
      * @param   mixed   $default  The default value to return if the named property does not exist.
+     * @param   string  $filter   The filter to apply to the value.
      *
-     * @return  mixed  The input value.
+     * @return  mixed  The filtered input value.
      *
+     * @see     \Joomla\Filter\InputFilter::clean()
      * @since   1.0
      */
-    public function get($name, $default = null)
+    public function get($name, $default = null, $filter = 'cmd')
     {
         if (isset($this->data[$name])) {
             $results = $this->decodeData(
@@ -61,6 +65,15 @@ public function get($name, $default = null)
                 ]
             );
 
+            // Prevent returning an unsafe file unless specifically requested
+            if (strtoupper($filter) !== 'RAW') {
+                $isSafe = InputFilter::isSafeFile($results);
+
+                if (!$isSafe) {
+                    return $default;
+                }
+            }
+
             return $results;
         }